Merge pull request #848 from marcoarnulfo:feat/cell-autocomplete

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -0,0 +1,48 @@
+# The AGENTS.md quality gate (`cargo xtask ci`: fmt, clippy -D warnings, tests, assets, layers,
+# wasm, parity --check) on every pull request and every push to main, so a merge burst can't land
+# a red tree that only the next agent session discovers.
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    name: cargo xtask ci
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    env:
+      CARGO_TERM_COLOR: always
+      CARGO_INCREMENTAL: "0"
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install Linux build dependencies (winit, wgpu, rfd)
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            pkg-config libxkbcommon-dev libwayland-dev libx11-dev libxcursor-dev libxrandr-dev \
+            libxi-dev libgtk-3-dev libfontconfig1-dev libfreetype-dev mesa-vulkan-drivers
+
+      - name: Install Rust (stable + clippy, rustfmt, wasm32)
+        run: |
+          rustup toolchain install stable --profile minimal --component clippy,rustfmt \
+            --target wasm32-unknown-unknown
+          rustup default stable
+
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Quality gate
+        run: cargo xtask ci

AGENTS.md

@@ -26,7 +26,7 @@ People trust GridCraft with their numbers; a crash loses their work. **This outr
 - **Input-derived numbers are hostile** (files, formulas, commands, MCP/control params): `get()` instead of indexing, checked/saturating arithmetic, cap input-sized allocations (huge ranges, `REPT`, `SEQUENCE`, whole-column references).
 - **Bound recursion** (formula nesting, dependency chains, names referring to names).
 - **Last-resort guard:** `Session::execute` catches escaped panics and restores the workbook. It's a safety net, not a licence.
-- **Prove it:** every crash fix lands with a regression test (`tests::every_command_survives_empty_params` fuzzes every command).
+- **Prove it:** every crash fix lands with a regression test (`tests::every_command_survives_empty_params` fuzzes every command; `crates/engine/tests/command_sequence_fuzz.rs` fuzzes random command sequences against undo/redo, XLSX round-trip and full-recalc invariants; soak it with `GRIDCRAFT_FUZZ_SEEDS`/`GRIDCRAFT_FUZZ_STEPS`, replay with `GRIDCRAFT_FUZZ_SEED`).
 - Crates carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
 
 ## Non-negotiables

CLAUDE.md

@@ -26,7 +26,7 @@ People trust GridCraft with their numbers; a crash loses their work. **This outr
 - **Input-derived numbers are hostile** (files, formulas, commands, MCP/control params): `get()` instead of indexing, checked/saturating arithmetic, cap input-sized allocations (huge ranges, `REPT`, `SEQUENCE`, whole-column references).
 - **Bound recursion** (formula nesting, dependency chains, names referring to names).
 - **Last-resort guard:** `Session::execute` catches escaped panics and restores the workbook. It's a safety net, not a licence.
-- **Prove it:** every crash fix lands with a regression test (`tests::every_command_survives_empty_params` fuzzes every command).
+- **Prove it:** every crash fix lands with a regression test (`tests::every_command_survives_empty_params` fuzzes every command; `crates/engine/tests/command_sequence_fuzz.rs` fuzzes random command sequences against undo/redo, XLSX round-trip and full-recalc invariants; soak it with `GRIDCRAFT_FUZZ_SEEDS`/`GRIDCRAFT_FUZZ_STEPS`, replay with `GRIDCRAFT_FUZZ_SEED`).
 - Crates carry `#![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]`.
 
 ## Non-negotiables

Cargo.lock

@@ -121,6 +121,17 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
+[[package]]
+name = "aes"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35f0f96ce78e38c3dc6d8948aa8163d06385be74000f3c7a95bf1eef35d3ea32"
+dependencies = [
+ "cipher",
+ "cpubits",
+ "cpufeatures",
+]
+
 [[package]]
 name = "ahash"
 version = "0.8.12"
@@ -608,6 +619,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cipher"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
+dependencies = [
+ "crypto-common",
+ "inout",
+]
+
 [[package]]
 name = "clipboard-win"
 version = "5.4.1"
@@ -706,6 +727,12 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpubits"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.1"
@@ -715,6 +742,22 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "craft-print"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d#d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d"
+dependencies = [
+ "tempfile",
+]
+
+[[package]]
+name = "craft-ui"
+version = "0.1.0"
+source = "git+https://github.com/storytold/craft-libs?rev=d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d#d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d"
+dependencies = [
+ "egui",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.2"
@@ -1453,9 +1496,10 @@ dependencies = [
 
 [[package]]
 name = "gridcraft"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "arboard",
+ "craft-print",
  "eframe",
  "egui",
  "fmv-macos-events",
@@ -1464,6 +1508,8 @@ dependencies = [
  "image",
  "log",
  "muda",
+ "objc2 0.6.5",
+ "objc2-app-kit 0.3.2",
  "pollster 1.0.1",
  "rfd",
  "serde_json",
@@ -1472,7 +1518,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-calc"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -1484,7 +1530,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-chart"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-core",
@@ -1495,17 +1541,19 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-cli"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-engine",
  "gridcraft-mcp",
  "log",
+ "quick-xml",
  "serde_json",
+ "zip",
 ]
 
 [[package]]
 name = "gridcraft-core"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "js-sys",
  "serde",
@@ -1515,7 +1563,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-engine"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-calc",
  "gridcraft-chart",
@@ -1536,7 +1584,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-formula"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-core",
  "serde",
@@ -1545,7 +1593,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-functions"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-core",
  "regex",
@@ -1553,7 +1601,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-mcp"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-engine",
  "log",
@@ -1562,7 +1610,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-model"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-core",
  "gridcraft-formula",
@@ -1574,24 +1622,26 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-numfmt"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-core",
 ]
 
 [[package]]
 name = "gridcraft-pdf"
-version = "0.5.0"
+version = "0.6.1"
 
 [[package]]
 name = "gridcraft-ui-egui"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
+ "craft-ui",
  "egui",
  "egui_kittest",
  "epaint_default_fonts",
  "gridcraft-chart",
  "gridcraft-engine",
+ "gridcraft-xlsx",
  "image",
  "log",
  "serde",
@@ -1605,7 +1655,7 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-web"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "eframe",
  "egui",
@@ -1622,12 +1672,15 @@ dependencies = [
 
 [[package]]
 name = "gridcraft-xlsx"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
+ "aes",
  "gridcraft-core",
  "gridcraft-formula",
  "gridcraft-model",
  "quick-xml",
+ "sha1",
+ "sha2",
  "thiserror 2.0.21",
  "zip",
 ]
@@ -1741,6 +1794,15 @@ dependencies = [
  "hashbrown 0.17.1",
 ]
 
+[[package]]
+name = "inout"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "is-docker"
 version = "0.2.0"
@@ -3114,6 +3176,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "sha2"
 version = "0.11.0"
@@ -4453,7 +4526,7 @@ checksum = "e450f9b2ed1dff33c94c12589a87338689467b9c4f5d8a5710bd09a847d2c8a7"
 
 [[package]]
 name = "xtask"
-version = "0.5.0"
+version = "0.6.1"
 dependencies = [
  "gridcraft-engine",
  "serde_json",

Cargo.toml

@@ -4,7 +4,7 @@ members = ["crates/*", "apps/*", "xtask"]
 default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]
 
 [workspace.package]
-version = "0.5.0"
+version = "0.6.1"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 rust-version = "1.90"
@@ -35,6 +35,9 @@ regex = { version = "1", default-features = false, features = ["std", "unicode",
 quick-xml = "0.41"
 zip = { version = "3", default-features = false, features = ["deflate"] }
 sha2 = { version = "0.11", default-features = false }
+# Decrypting password-protected workbooks ([MS-OFFCRYPTO]): AES and SHA-1, pure Rust (wasm-safe).
+aes = { version = "0.9", default-features = false }
+sha1 = { version = "0.11", default-features = false }
 image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
 
 # ui

ROADMAP.md

@@ -2,7 +2,7 @@
 
 **Stage: alpha** · next: beta, ~25 points of "ready for real work" and ~160–240 h away
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-11 · **Change:** minor (community merges: worksheet functions 513 / 523, catalog 274 / 290) · **Target:** Microsoft Excel (Microsoft 365)
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-10-12 · **Change:** minor (rows auto-fit oversized fonts on open and whole-row/column formatting) · **Target:** Microsoft Excel (Microsoft 365)
 
 GridCraft aims at full Microsoft Excel parity, and at being better in places: faster, open (XLSX
 is the native format), fully scriptable by agents (MCP, control channel, CLI), and on the web.
@@ -32,7 +32,7 @@ This page is the summary. The detail is in:
 |---|---|---|---|
 | Full target (ready for real work) | ~50% | ~650–1,050 | Get & Transform and the data model, localization (twelve languages), charts depth, file fidelity (`.xls`, corpus, pass-through), PivotTables, collaboration, mobile |
 | Mainstream practitioner | ~50% | ~200–310 | File exchange with Excel users (corpus and Excel verification, pass-through, large files, `.xls`, encryption: 63–97 h), common-chart depth (30–45 h), PivotTables (20–30 h), keyboard and interaction (18–28 h), calc correctness and functions (20–33 h) |
-| Essentials user | ~63% | ~60–100 | Opening files people send (`.xls` and encrypted import 28–42 h; macOS Finder open 2–4 h), launch stability (6–10 h), basic chart resize and polish (6–10 h), print and Page Layout (8–12 h), small editing and UI fixes (10–16 h) |
+| Essentials user | ~63% | ~60–100 | Opening files people send (`.xls` import and saving with a password 24–36 h; macOS Finder open 2–4 h), launch stability (6–10 h), basic chart resize and polish (6–10 h), print and Page Layout (8–12 h), small editing and UI fixes (10–16 h) |
 
 Each tier is a subset of the one above, so its hours are too. Calibrated as in [Effort and
 calibration](docs/target-app-parity.md#effort-and-calibration) (~6–10 h per readiness point for the remaining, verification-heavy
@@ -132,6 +132,24 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in
 
 | Date | What landed |
 |---|---|
+| 2026-10-12 | Rows auto-fit oversized fonts: opening a file and whole-row/column formatting grow non-custom rows to their tallest font (#833) |
+| 2026-10-12 | Number formats: parsing a format code is linear in its length (long runs of `[`, `,` or `/` no longer take quadratic time), and an unclosed `[` is a literal when splitting sections as well as when tokenizing (#810) |
+| 2026-10-12 | Number formats: a fraction denominator with 65,536 zeros no longer crashes; format codes are capped at 255 characters like Excel (longer codes display as General, `TEXT` gives `#VALUE!`) (#807) |
+| 2026-10-12 | Security: cell hyperlinks open only http, https and mailto, after a confirmation; other schemes (file:, smb:, UNC, custom handlers) are refused (#777, part 1) |
+| 2026-10-12 | Deleting several Ctrl-selected rows or columns removes them all in one undo step (#758) |
+| 2026-10-12 | XLSX chart sheets are kept on open and save: the sheet, its drawing and chart (with style and colours) are written back unchanged in their place among the worksheets, and left out when the sheet they plot is deleted or renamed or a worksheet took their name (#727) |
+| 2026-10-12 | CSV and tab-separated export is capped at 512 MiB: a sheet whose used range would expand to more (two cells far apart, such as A1 and XFD1048576, are 16 GiB of commas) is refused with the rows, columns and limit, before anything is allocated or written (#528) |
+| 2026-10-12 | PDF writer hardening: text width cannot overflow, all-zero dash arrays and negative or NaN stroke widths are sanitised, non-finite sizes and positions draw nothing (#812) |
+| 2026-10-12 | PDF export writes the document title and author as UTF-16BE when they are not ASCII, so viewers show accents, currency signs and non-Latin text correctly (#813) |
+| 2026-10-12 | `TEXT()` over a range and chart labels parse each number format code once instead of once per value (#806) |
+| 2026-10-12 | SUBTOTAL(109) over hidden rows recalculates after Row Height, AutoFit Row Height and Ungroup reveal rows (found by the command-sequence fuzz) |
+| 2026-10-12 | Page Layout view: drag the margin edges on the rulers to set the page margins (resize cursor, live preview, value tooltip, one undo step, Esc cancels) (#792) |
+| 2026-10-12 | Forecast Sheet gets Forecast Start: begin the forecast inside the history to compare it with the actuals (#785) |
+| 2026-10-12 | Ink strokes save as unfilled DrawingML paths and reopen as editable ink with their points, colour and width; icons in #551 remain a follow-up |
+| 2026-10-12 | The selection outline stays visible when extended to the last row (Ctrl+Shift+Down): its sides are cut to the viewport instead of stroking a 20-million-point rectangle (#687) |
+| 2026-10-12 | File › Print selects a system printer, copies, duplex and grayscale, submits PDF jobs through craft-print on a worker and shows spooler errors; browser printing and PDF export remain available |
+| 2026-10-11 | Command-sequence fuzzing: random command sequences checked against undo/redo, XLSX round-trip and full recalculation; fixes for the table, legacy-array, spill, AutoSum, Watch Window and sheet-copy bugs it found |
+| 2026-10-11 | Password-protected workbooks open: GridCraft asks for the password and decrypts Agile and Standard encryption (#11) |
 | 2026-10-11 | Text boxes keep their formatting: run size, bold, italic, typeface, text colour and outline, alignment, vertical anchor and "no outline" (#377) |
 | 2026-10-11 | Desktop printing opens the print PDF in the system viewer; Save As offers CSV, web page and PDF; macOS File › Properties opens File › Info (#370, #343) |
 | 2026-10-11 | Windows: DirectX 12 shaders compile with FXC, so a missing or stray `dxcompiler.dll` no longer stops the app at start (#339, #354) |
@@ -175,6 +193,14 @@ Ranked; estimates in Opus 5.5 agent-hours. Detail and the full beta-gate list in
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-10-12 | minor | Rows auto-fit oversized fonts on open and whole-row/column formatting (#833); progress log row |
+| 2026-10-12 | minor | Progress log: multi-area row/column delete (#758) |
+| 2026-10-12 | trivial | Progress log: XLSX chart sheets kept on save (#727) |
+| 2026-10-12 | trivial | Progress log: CSV export size cap (#528) |
+| 2026-10-12 | minor | Progress log: margins dragged on the Page Layout rulers (#792) |
+| 2026-10-12 | minor | Ink preservation across XLSX save/reopen (ink portion of #551) |
+| 2026-10-12 | minor | Desktop File > Print now discovers printers and submits PDF jobs through pinned craft-print with printer choice, copies, duplex and grayscale; browser printing and PDF export remain available. Remaining print parity includes page ranges and driver-specific tray/options UI; physical printer fidelity needs hardware validation. |
+| 2026-10-11 | minor | Password-encrypted workbooks open (#11); progress log row |
 | 2026-10-11 | minor | Forecast Sheet (#322); progress log row |
 | 2026-10-11 | minor | Worksheet functions 505 / 523 (ODD* bond functions); progress log row |
 | 2026-10-11 | minor | Worksheet functions 503 / 523 (PERCENTOF, EUROCONVERT); progress log row |

apps/gridcraft-cli/Cargo.toml

@@ -18,3 +18,6 @@ gridcraft-engine = { workspace = true }
 gridcraft-mcp = { workspace = true }
 serde_json = { workspace = true }
 log = { workspace = true }
+# `check`: validating the packages GridCraft writes (content types, relationships).
+zip = { workspace = true }
+quick-xml = { workspace = true }

apps/gridcraft-cli/src/main.rs

@@ -5,6 +5,7 @@
 //! gridcraft-cli convert <in> <out> [--sheet NAME]
 //! gridcraft-cli eval <formula> [--in FILE] [--sheet S] [--cell A1] [--json]
 //! gridcraft-cli cat <file> [--range A1:D20] [--sheet S] [--formulas] [--csv]
+//! gridcraft-cli check <file-or-dir>... [--json] [--tolerance 1e-9] [--max-report N]
 //! gridcraft-cli run [--in FILE | --sample NAME] [--cmd 'id={json}']... [--script FILE.jsonl] [--out FILE] [--print RANGE] [--quiet]
 //! gridcraft-cli commands [--json] [--search X]
 //! gridcraft-cli functions [--json] [--search X] [--category C]
@@ -28,6 +29,8 @@ macro_rules! outln {
     }};
 }
 
+mod check;
+
 use gridcraft_engine::Session;
 use serde_json::{Value, json};
 
@@ -36,6 +39,8 @@ const USAGE: &str = "usage:
   gridcraft-cli convert <in> <out> [--sheet NAME]         xlsx/csv/tsv/json/html by extension
   gridcraft-cli eval <formula> [--in FILE] [--sheet S] [--cell A1] [--json]
   gridcraft-cli cat <file> [--range A1:D20] [--sheet S] [--formulas] [--csv]
+  gridcraft-cli check <file-or-dir>... [--json] [--tolerance 1e-9] [--max-report N]
+                     cached-value calc oracle + XLSX round-trip fidelity (exit 1 on any difference)
   gridcraft-cli run [--in FILE | --sample NAME] [--cmd 'id={json}']... [--script FILE.jsonl]
                      [--out FILE] [--print RANGE] [--quiet]
   gridcraft-cli commands [--json] [--search X]
@@ -71,6 +76,7 @@ fn main() -> ExitCode {
         Some("eval") => eval(rest),
         Some("cat") => cat(rest),
         Some("run") => run(rest),
+        Some("check") => return check::main(rest),
         Some("commands") => commands(rest),
         Some("functions") => functions(rest),
         Some("mcp") => mcp(rest),
@@ -271,7 +277,7 @@ fn convert(args: &[String]) -> Result<(), String> {
     let mut s = open(input)?;
     activate_sheet(&mut s, a.opt("sheet"))?;
     let d = s.doc().map_err(|e| e.to_string())?;
-    let bytes = gridcraft_engine::io::save_bytes(&d.wb, out).map_err(|e| e.to_string())?;
+    let bytes = gridcraft_engine::io::save_file_bytes(&d.wb, out).map_err(|e| e.to_string())?;
     gridcraft_engine::io::write_file(out, &bytes).map_err(|e| e.to_string())?;
     eprintln!("wrote {out} ({} bytes)", bytes.len());
     Ok(())

apps/gridcraft-cli/tests/cli.rs

@@ -150,3 +150,27 @@ fn mcp_over_stdio() {
     assert_eq!(lines[0]["result"]["serverInfo"]["name"], "gridcraft");
     assert!(lines[1]["result"]["content"][0]["text"].as_str().unwrap().contains("42"));
 }
+
+#[test]
+fn check_exit_codes_and_json() {
+    let dir = tmpdir("check");
+    let book = dir.join("calc.xlsx");
+    let book_s = book.to_str().unwrap();
+    ok(&["run", "--cmd", r#"cell.set={"cell":"A1","input":"2"}"#, "--cmd", r#"cell.set={"cell":"B1","input":"=A1*3"}"#, "--out", book_s, "--quiet"]);
+    // GridCraft's own file: its cached values are its own results, and it round-trips.
+    let o = run(&["check", dir.to_str().unwrap()]);
+    let out = String::from_utf8_lossy(&o.stdout);
+    assert_eq!(o.status.code(), Some(0), "{out}");
+    assert!(out.contains("1 checked: 1 matched, 0 mismatched"), "{out}");
+    let v: serde_json::Value = serde_json::from_str(&ok(&["check", book_s, "--json"])).unwrap();
+    assert_eq!(v["schema"], "gridcraft-check/1");
+    assert_eq!(v["totals"]["matched"], 1);
+    // A file that can't be opened is reported, not fatal, and fails the check.
+    let o = run(&["check", book_s, "/no/such/file.xlsx"]);
+    assert_eq!(o.status.code(), Some(1));
+    assert!(String::from_utf8_lossy(&o.stdout).contains("1 failed to open"));
+    // Usage errors exit 2.
+    assert_eq!(run(&["check"]).status.code(), Some(2));
+    assert_eq!(run(&["check", book_s, "--tolerance", "x"]).status.code(), Some(2));
+    assert_eq!(run(&["check", book_s, "--bogus"]).status.code(), Some(2));
+}

apps/gridcraft-web/Cargo.toml

@@ -26,4 +26,4 @@ rfd = { workspace = true }
 wasm-bindgen = "0.2"
 wasm-bindgen-futures = "0.4"
 js-sys = "0.3"
-web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Clipboard", "ClipboardItem", "Navigator"] }
+web-sys = { version = "0.3", features = ["Window", "Document", "Element", "HtmlElement", "HtmlCanvasElement", "HtmlAnchorElement", "HtmlIFrameElement", "Blob", "BlobPropertyBag", "Url", "Location", "CssStyleDeclaration", "Clipboard", "ClipboardItem", "Navigator", "MessageEvent", "UrlSearchParams"] }

apps/gridcraft-web/src/host.rs

@@ -0,0 +1,166 @@
+//! The `postMessage` bridge to a same-origin parent page (`?host=parent`), for pages that embed
+//! GridCraft in an `<iframe>` (such as a Nextcloud app). Messages are plain objects with a `type`:
+//!
+//! - `gridcraft:ready` (to the parent): `{ version }`, the app is listening; send a file now.
+//! - `gridcraft:open` (from the parent): `{ name, bytes }`, bytes an `ArrayBuffer` or
+//!   `Uint8Array`. It opens like a workbook picked with File › Open or dropped on the window.
+//! - `gridcraft:save` (to the parent): `{ name, bytes }` (a transferred `ArrayBuffer`) for every
+//!   file GridCraft would otherwise download: Save and Save As (an .xlsx workbook) and Export
+//!   as PDF. The parent stores it and reports failures itself.
+//! - `gridcraft:dirty` (to the parent): `{ dirty }` whenever unsaved changes appear or go away.
+//! - `gridcraft:failed` (to the parent): `{ error }` when the app couldn't start.
+//!
+//! Only the parent window on the page's own origin is heard or answered. In host mode the page
+//! starts with an empty workbook instead of a sample, and the parent guards leaving the page.
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use gridcraft_ui_egui::{Inbox, Services, SheetApp};
+use wasm_bindgen::JsCast as _;
+use wasm_bindgen::JsValue;
+use wasm_bindgen::closure::Closure;
+
+/// Saving one of these hands the whole workbook to the parent, which stores it: the workbook
+/// counts as saved under that name, as it would after Save on the desktop.
+const WORKBOOK_EXTS: &[&str] = &["xlsx"];
+
+/// The longest user name taken from `?author=`.
+const MAX_AUTHOR_CHARS: usize = 200;
+
+#[derive(Clone)]
+pub struct Bridge {
+    window: web_sys::Window,
+    parent: web_sys::Window,
+    origin: String,
+    /// Names of the files handed to the parent since the last frame.
+    saved: Rc<RefCell<Vec<String>>>,
+    /// The unsaved-changes state last reported to the parent.
+    reported: Rc<Cell<Option<bool>>>,
+}
+
+impl Bridge {
+    /// `None` when the page isn't framed (there is no parent to talk to).
+    pub fn new() -> Option<Self> {
+        let window = web_sys::window()?;
+        let parent = window.parent().ok().flatten()?;
+        if js_sys::Object::is(&parent, &window) {
+            return None;
+        }
+        let origin = window.location().origin().ok()?;
+        Some(Self { window, parent, origin, saved: Rc::default(), reported: Rc::default() })
+    }
+
+    /// Send saved and exported files to the parent instead of downloading them, and hear files
+    /// from it.
+    pub fn connect(&self, services: &mut Services, inbox: Inbox, ctx: egui::Context) {
+        self.listen(inbox, ctx);
+        let bridge = self.clone();
+        services.download = Some(Box::new(move |name: &str, bytes: &[u8]| {
+            if let Err(e) = bridge.post_save(name, bytes) {
+                log::error!("couldn't hand {name} to the page: {e}");
+            }
+        }));
+    }
+
+    /// `?author=`: the host's name for the user signs new notes and comments.
+    pub fn set_author(app: &mut SheetApp, author: &str) {
+        let author: String = author.trim().chars().take(MAX_AUTHOR_CHARS).collect();
+        if !author.is_empty() {
+            app.session.prefs.user_name = author;
+        }
+    }
+
+    pub fn post_ready(&self) {
+        self.send(&[("type", "gridcraft:ready".into()), ("version", env!("CARGO_PKG_VERSION").into())]);
+    }
+
+    pub fn post_failed(&self, error: &str) {
+        self.send(&[("type", "gridcraft:failed".into()), ("error", error.into())]);
+    }
+
+    /// After each frame: a workbook handed to the parent this frame counts as saved under the
+    /// name it was saved as, and the parent hears when unsaved changes appear or go away.
+    pub fn sync(&self, app: &mut SheetApp) {
+        let saved = std::mem::take(&mut *self.saved.borrow_mut());
+        if let Some(name) = saved.iter().rev().find(|name| is_workbook(name))
+            && let Some(doc) = app.session.active_mut()
+        {
+            doc.saved = doc.wb.clone();
+            if doc.path.is_none() {
+                doc.title = name.clone();
+            }
+        }
+        let dirty = app.session.documents().iter().any(|d| d.is_dirty());
+        if self.reported.get() != Some(dirty) && self.send(&[("type", "gridcraft:dirty".into()), ("dirty", dirty.into())]) {
+            self.reported.set(Some(dirty));
+        }
+    }
+
+    fn post_save(&self, path: &str, bytes: &[u8]) -> Result<(), String> {
+        let name = std::path::Path::new(path).file_name().map(|n| n.to_string_lossy().to_string()).unwrap_or_else(|| path.to_string());
+        let buffer = js_sys::Uint8Array::from(bytes).buffer();
+        let message = message(&[("type", "gridcraft:save".into()), ("name", name.as_str().into()), ("bytes", buffer.clone().into())])
+            .ok_or_else(|| "couldn't build the message".to_string())?;
+        self.parent
+            .post_message_with_transfer(&message, &self.origin, &js_sys::Array::of1(&buffer))
+            .map_err(|e| e.as_string().unwrap_or_else(|| format!("{e:?}")))?;
+        self.saved.borrow_mut().push(name);
+        Ok(())
+    }
+
+    fn listen(&self, inbox: Inbox, ctx: egui::Context) {
+        let parent = self.parent.clone();
+        let origin = self.origin.clone();
+        let on_message = Closure::<dyn FnMut(web_sys::MessageEvent)>::new(move |event: web_sys::MessageEvent| {
+            if event.origin() != origin || !event.source().is_some_and(|s| js_sys::Object::is(&s, &parent)) {
+                return;
+            }
+            let data = event.data();
+            if string(&data, "type").as_deref() != Some("gridcraft:open") {
+                return;
+            }
+            let name = string(&data, "name").filter(|n| !n.trim().is_empty()).unwrap_or_else(|| "Book.xlsx".to_string());
+            let Some(bytes) = bytes(&data) else { return };
+            inbox.lock().unwrap_or_else(|e| e.into_inner()).push((name, bytes));
+            ctx.request_repaint();
+        });
+        if self.window.add_event_listener_with_callback("message", on_message.as_ref().unchecked_ref()).is_ok() {
+            // The listener lives as long as the page.
+            on_message.forget();
+        }
+    }
+
+    /// Post a message to the parent; false if it couldn't be sent.
+    fn send(&self, fields: &[(&str, JsValue)]) -> bool {
+        message(fields).is_some_and(|m| self.parent.post_message(&m, &self.origin).is_ok())
+    }
+}
+
+fn is_workbook(name: &str) -> bool {
+    name.rsplit_once('.').is_some_and(|(_, ext)| WORKBOOK_EXTS.iter().any(|e| ext.eq_ignore_ascii_case(e)))
+}
+
+fn message(fields: &[(&str, JsValue)]) -> Option<js_sys::Object> {
+    let m = js_sys::Object::new();
+    for (key, value) in fields {
+        js_sys::Reflect::set(&m, &JsValue::from_str(key), value).ok()?;
+    }
+    Some(m)
+}
+
+fn string(data: &JsValue, key: &str) -> Option<String> {
+    js_sys::Reflect::get(data, &JsValue::from_str(key)).ok()?.as_string()
+}
+
+/// `bytes` as an `ArrayBuffer` or `Uint8Array`.
+fn bytes(data: &JsValue) -> Option<Vec<u8>> {
+    let bytes = js_sys::Reflect::get(data, &JsValue::from_str("bytes")).ok()?;
+    if let Some(array) = bytes.dyn_ref::<js_sys::Uint8Array>() {
+        Some(array.to_vec())
+    } else if bytes.is_instance_of::<js_sys::ArrayBuffer>() {
+        Some(js_sys::Uint8Array::new(&bytes).to_vec())
+    } else {
+        None
+    }
+}

apps/gridcraft-web/src/main.rs

@@ -8,9 +8,14 @@
 //! (bytes arrive asynchronously through `Services::inbox`); Save downloads the file; dropped
 //! files are read asynchronously.
 //!
-//! URL query flags: `?webgl` forces WebGL2; `?sample=sales|budget|grades` opens a sample.
+//! URL query flags: `?webgl` forces WebGL2; `?sample=sales|budget|grades` opens a sample;
+//! `?host=parent` (inside an `<iframe>`) talks to a same-origin parent page instead: it sends the
+//! workbook to open and stores what GridCraft saves (`host`), and `&author=` names the user for
+//! notes and comments.
 #![deny(clippy::unwrap_used, clippy::expect_used, clippy::panic, clippy::unimplemented, clippy::todo, clippy::unreachable)]
 
+#[cfg(target_arch = "wasm32")]
+mod host;
 #[cfg(target_arch = "wasm32")]
 mod web;
 

apps/gridcraft-web/src/web.rs

@@ -25,6 +25,10 @@ pub fn start() {
         {
             create.instance_descriptor.backends = eframe::wgpu::Backends::GL;
         }
+        // `?host=parent`: a same-origin page framing GridCraft (such as a Nextcloud app) opens
+        // workbooks in it and stores what it saves (`host`).
+        let bridge = if query_param("host").as_deref() == Some("parent") { crate::host::Bridge::new() } else { None };
+        let app_bridge = bridge.clone();
         let result = eframe::WebRunner::new()
             .start(
                 canvas,
@@ -32,13 +36,18 @@ pub fn start() {
                 Box::new(move |cc| {
                     let inbox: Inbox = Inbox::default();
                     let mut session = Session::new();
-                    let q = query();
+                    // In host mode the parent sends the workbook to edit; no sample meanwhile.
+                    let q = if app_bridge.is_some() { String::new() } else { query() };
                     if let Some(name) = q.split(['?', '&']).find_map(|kv| kv.strip_prefix("sample=")) {
                         let _ = session.execute("file.new", serde_json::json!({"sample": name}));
                     } else if q.contains("sample") {
                         let _ = session.execute("file.new", serde_json::json!({"sample": "sales"}));
                     }
-                    let mut app = SheetApp::new(session, services(inbox.clone(), cc.egui_ctx.clone()));
+                    let mut services = services(inbox.clone(), cc.egui_ctx.clone());
+                    if let Some(bridge) = &app_bridge {
+                        bridge.connect(&mut services, inbox.clone(), cc.egui_ctx.clone());
+                    }
+                    let mut app = SheetApp::new(session, services);
                     app.ui.system_theme = true;
                     // Follow the browser's language, except a CJK one: the web build has no system
                     // CJK fonts (none are bundled), so that interface would render as tofu.
@@ -50,10 +59,19 @@ pub fn start() {
                         app.ui.language = browser;
                     }
                     SheetApp::setup_context_for_language(&cc.egui_ctx, false, app.ui.language);
-                    Ok(Box::new(WebShell { app, inbox }))
+                    if let Some(bridge) = &app_bridge {
+                        if let Some(author) = query_param("author") {
+                            crate::host::Bridge::set_author(&mut app, &author);
+                        }
+                        bridge.post_ready();
+                    }
+                    Ok(Box::new(WebShell { app, inbox, bridge: app_bridge }))
                 }),
             )
             .await;
+        if let (Err(e), Some(bridge)) = (&result, &bridge) {
+            bridge.post_failed(&format!("{e:?}"));
+        }
         if let Some(el) = document.get_element_by_id(LOADING_ID) {
             match result {
                 Ok(()) => el.remove(),
@@ -67,9 +85,14 @@ fn query() -> String {
     web_sys::window().and_then(|w| w.location().search().ok()).unwrap_or_default()
 }
 
+fn query_param(key: &str) -> Option<String> {
+    web_sys::UrlSearchParams::new_with_str(&query()).ok()?.get(key)
+}
+
 struct WebShell {
     app: SheetApp,
     inbox: Inbox,
+    bridge: Option<crate::host::Bridge>,
 }
 
 impl eframe::App for WebShell {
@@ -98,6 +121,9 @@ impl eframe::App for WebShell {
 
     fn ui(&mut self, ui: &mut egui::Ui, _frame: &mut eframe::Frame) {
         self.app.ui(ui);
+        if let Some(bridge) = &self.bridge {
+            bridge.sync(&mut self.app);
+        }
     }
 }
 
@@ -144,8 +170,10 @@ fn services(inbox: Inbox, ctx: egui::Context) -> Services {
             }
         })),
         open_url: Some(Box::new(|url: &str| {
-            if let Some(w) = web_sys::window() {
-                let _ = w.open_with_url_and_target(url, "_blank");
+            if let Some(w) = web_sys::window()
+                && let gridcraft_engine::links::LinkKind::External(url) = gridcraft_engine::links::classify(url)
+            {
+                let _ = w.open_with_url_and_target(&url, "_blank");
             }
         })),
         inbox: Some(inbox),

apps/gridcraft/Cargo.toml

@@ -24,6 +24,7 @@ image = { workspace = true }
 winresource = "0.1"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+craft-print = { git = "https://github.com/storytold/craft-libs", rev = "d27646a5f7c8b4fc85d9dd3213b8c88b58e0088d" }
 rfd = { workspace = true }
 arboard = { workspace = true }
 
@@ -41,3 +42,13 @@ muda = { version = "0.21", default-features = false }
 # by PdfCraft and PhotoCraft) registers the handler (Objective-C interop needs unsafe, which our
 # workspace forbids) behind a safe API. Pinned exactly: review the diff before bumping.
 fmv-macos-events = "=0.1.0"
+
+# tests/mac_menu_appkit.rs: reads AppKit's menu bar back. Already in Cargo.lock (muda, winit);
+# pinned exactly to the same versions.
+[target.'cfg(target_os = "macos")'.dev-dependencies]
+objc2 = "=0.6.5"
+objc2-app-kit = { version = "=0.3.2", default-features = false, features = ["std", "NSApplication", "NSMenu", "NSMenuItem", "NSResponder"] }
+
+[[test]]
+name = "mac_menu_appkit"
+harness = false

apps/gridcraft/src/main.rs

@@ -16,6 +16,7 @@ mod graphics;
 mod logging;
 #[cfg(target_os = "macos")]
 mod native_menu;
+mod print;
 
 use std::cell::RefCell;
 use std::rc::Rc;
@@ -39,6 +40,10 @@ impl eframe::App for App {
             apple_events::poll(&self.2, &mut self.0, ctx);
         }
         self.0.logic(ctx);
+        self.0.poll_printing(ctx);
+        if ctx.input(|input| input.viewport().close_requested()) && self.0.printing.busy() {
+            ctx.send_viewport_cmd(egui::ViewportCommand::CancelClose);
+        }
     }
     fn raw_input_hook(&mut self, _ctx: &egui::Context, raw: &mut egui::RawInput) {
         self.0.raw_input_hook(raw);
@@ -53,6 +58,7 @@ impl eframe::App for App {
         self.0.ui(ui);
     }
     fn on_exit(&mut self) {
+        print::finish_pending_jobs();
         save_prefs(&self.0);
         // macOS (#117): end the process here, before eframe tears the window down. AccessKit's
         // macOS adapter subclasses the window's content view and restores its class on teardown;
@@ -129,10 +135,22 @@ fn save_prefs(app: &SheetApp) {
     }
 }
 
+/// Read the system clipboard through the shared handle, creating it on first use.
+fn read_clipboard<T>(
+    handle: &RefCell<Option<arboard::Clipboard>>,
+    read: impl FnOnce(&mut arboard::Clipboard) -> Result<T, arboard::Error>,
+) -> Option<T> {
+    let mut clipboard = handle.try_borrow_mut().ok()?;
+    if clipboard.is_none() {
+        *clipboard = arboard::Clipboard::new().ok();
+    }
+    read(clipboard.as_mut()?).ok()
+}
+
 fn services() -> Services {
     // Keep the owner alive: X11/Wayland serve clipboard data from this handle.
     let clipboard: Rc<RefCell<Option<arboard::Clipboard>>> = Rc::default();
-    let paste_clipboard = clipboard.clone();
+    let (html_clipboard, text_clipboard) = (clipboard.clone(), clipboard.clone());
     Services {
         copy_html: Some(Box::new(move |html, text| {
             let mut clipboard = clipboard.borrow_mut();
@@ -141,13 +159,8 @@ fn services() -> Services {
             }
             clipboard.as_mut().ok_or("clipboard unavailable")?.set_html(html, Some(text)).map_err(|e| e.to_string())
         })),
-        paste_html: Some(Box::new(move || {
-            let mut clipboard = paste_clipboard.try_borrow_mut().ok()?;
-            if clipboard.is_none() {
-                *clipboard = arboard::Clipboard::new().ok();
-            }
-            clipboard.as_mut()?.get().html().ok()
-        })),
+        paste_html: Some(Box::new(move || read_clipboard(&html_clipboard, |clipboard| clipboard.get().html()))),
+        paste_text: Some(Box::new(move || read_clipboard(&text_clipboard, |clipboard| clipboard.get_text()))),
         pick_open: Some(Box::new(|| {
             rfd::FileDialog::new()
                 .add_filter("Spreadsheets", &["xlsx", "xlsm", "xls", "xlsb", "ods", "csv", "tsv", "txt", "json"])
@@ -180,18 +193,21 @@ fn services() -> Services {
             dialog.save_file().and_then(|p| p.to_str().map(str::to_string))
         })),
         open_url: Some(Box::new(|url: &str| open_with_system(url))),
-        // File › Print, Ctrl+P: the print PDF opens in the system's PDF viewer, whose Print
-        // command reaches the printer dialog (GridCraft has no printer driver of its own).
-        print: Some(Box::new(|bytes: &[u8]| match write_print_pdf(&std::env::temp_dir(), bytes) {
-            Ok(path) => open_with_system(&path.to_string_lossy()),
-            Err(e) => log::warn!("print: {e}"),
-        })),
+        printers: Some(print::discover()),
+        print_native: Some(print::submit()),
         ..Default::default()
     }
 }
 
 /// Opens a URL or file with the system's default application.
 fn open_with_system(target: &str) {
+    // Last line of defence behind `link.open` and the click prompt: the system only ever gets
+    // http, https and mailto addresses.
+    let gridcraft_engine::links::LinkKind::External(target) = gridcraft_engine::links::classify(target) else {
+        log::warn!("refused to open {target:?}: only http, https and mailto links are opened");
+        return;
+    };
+    let target = target.as_str();
     let cmd = if cfg!(target_os = "macos") {
         "open"
     } else if cfg!(windows) {
@@ -204,32 +220,6 @@ fn open_with_system(target: &str) {
     }
 }
 
-/// Writes a print PDF into `dir` under a fresh name (an earlier print may still be open in the
-/// viewer) and returns its path. The temp folder is shared, so the file is created exclusively
-/// (an existing file or a planted symlink is never followed or overwritten) and, on Unix, readable
-/// only by the user.
-fn write_print_pdf(dir: &std::path::Path, bytes: &[u8]) -> std::io::Result<std::path::PathBuf> {
-    use std::io::Write;
-    static PRINTS: std::sync::atomic::AtomicU32 = std::sync::atomic::AtomicU32::new(0);
-    for _ in 0..64 {
-        let n = PRINTS.fetch_add(1, std::sync::atomic::Ordering::Relaxed).wrapping_add(1);
-        let path = dir.join(format!("GridCraft print {}-{n}.pdf", std::process::id()));
-        let mut options = std::fs::OpenOptions::new();
-        options.write(true).create_new(true);
-        #[cfg(unix)]
-        std::os::unix::fs::OpenOptionsExt::mode(&mut options, 0o600);
-        match options.open(&path) {
-            Ok(mut file) => {
-                file.write_all(bytes)?;
-                return Ok(path);
-            }
-            Err(e) if e.kind() == std::io::ErrorKind::AlreadyExists => continue,
-            Err(e) => return Err(e),
-        }
-    }
-    Err(std::io::Error::new(std::io::ErrorKind::AlreadyExists, "no free print file name"))
-}
-
 fn icon() -> Option<egui::IconData> {
     #[cfg(target_os = "macos")]
     let bytes = include_bytes!("../../../assets/app-icon/gridcraft-macos-512.png");
@@ -304,19 +294,20 @@ fn main() -> eframe::Result<()> {
     {
         log::warn!("sample {s}: {e}");
     }
-    for f in &files {
-        if let Err(e) = session.execute("file.open", json!({"path": f})) {
-            log::warn!("{f}: {e}");
-        }
-    }
     if session.documents().is_empty() {
         session.new_workbook();
     }
     let mut app = SheetApp::new(session, services());
     app.watch_desktop_theme();
-    app.after_engine(); // Show warnings from files opened on the command line.
+    app.after_engine(); // Show warnings from the sample.
     let control_port = control_port;
     load_prefs(&mut app);
+    // Files named on the command line (a double-click on Windows and Linux) open as File › Open
+    // opens them: a password-protected one asks for its password, and errors are shown, not
+    // only logged. Each replaces the untouched blank Book1, as a file opened from Finder does.
+    for f in &files {
+        app.open_path(f);
+    }
     let mut viewport = egui::ViewportBuilder::default()
         .with_title("GridCraft")
         .with_inner_size([1440.0, 900.0])
@@ -394,31 +385,30 @@ fn main() -> eframe::Result<()> {
 }
 
 #[cfg(test)]
-mod print_tests {
+mod packaging_tests {
+    use gridcraft_engine::io::FileKind;
+
+    /// The text between `start` and `end` that follows each `marker` in `text`, sorted (e.g. the
+    /// `xlsb` in `Classes\.xlsb\OpenWithProgids`).
+    fn extensions(text: &str, marker: &str, start: &str, end: char) -> Vec<String> {
+        let mut v: Vec<String> = text.split(marker).skip(1).filter_map(|s| s.split_once(start)?.1.split(end).next()).map(str::to_string).collect();
+        v.sort();
+        v
+    }
+
+    /// macOS Open With (`CFBundleDocumentTypes`) offers GridCraft for the same files as Windows
+    /// Open with, and GridCraft opens each of them. #321 added `.xlsb` and `.ods` on Windows and
+    /// Linux only.
     #[test]
-    fn print_pdfs_get_fresh_names_in_the_given_folder() {
-        let dir = std::env::temp_dir().join(format!("gridcraft-print-test-{}", std::process::id()));
-        std::fs::create_dir_all(&dir).unwrap();
-        let a = super::write_print_pdf(&dir, b"%PDF-1.4 a").unwrap();
-        let b = super::write_print_pdf(&dir, b"%PDF-1.4 b").unwrap();
-        assert_ne!(a, b);
-        assert!(a.starts_with(&dir) && a.extension().is_some_and(|e| e == "pdf"));
-        assert_eq!(std::fs::read(&b).unwrap(), b"%PDF-1.4 b");
-        assert!(super::write_print_pdf(&dir.join("missing"), b"x").is_err());
-        // A file (or symlink) already at the next name is skipped, never overwritten.
-        let pid = std::process::id();
-        let taken: Vec<_> = (1..=200).map(|n| dir.join(format!("GridCraft print {pid}-{n}.pdf"))).filter(|p| !p.exists()).take(3).collect();
-        for p in &taken {
-            std::fs::write(p, b"keep").unwrap();
+    fn macos_and_windows_offer_the_same_file_types() {
+        let plist = include_str!("../../../packaging/macos/Info.plist.in");
+        let wxs = include_str!("../../../packaging/windows/gridcraft.wxs");
+        let mac = extensions(plist, "<key>CFBundleTypeExtensions</key>", "<string>", '<');
+        let win = extensions(wxs, "Key=\"Software\\Classes\\.", "", '\\');
+        assert!(mac.iter().any(|e| e == "xlsx"), "Info.plist.in extensions not found: {mac:?}");
+        assert_eq!(mac, win);
+        for ext in &mac {
+            assert!(FileKind::from_path(&format!("book.{ext}")).is_some(), "GridCraft doesn't open .{ext}");
         }
-        let c = super::write_print_pdf(&dir, b"%PDF-1.4 c").unwrap();
-        assert!(taken.iter().all(|p| std::fs::read(p).unwrap() == b"keep"));
-        assert_eq!(std::fs::read(&c).unwrap(), b"%PDF-1.4 c");
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            assert_eq!(std::fs::metadata(&c).unwrap().permissions().mode() & 0o077, 0, "only the user can read it");
-        }
-        let _ = std::fs::remove_dir_all(&dir);
     }
 }

apps/gridcraft/src/native_menu.rs

@@ -24,6 +24,7 @@ fn tree() -> Vec<(&'static str, Vec<Entry>)> {
                 ("Close", "file.close", Some("CMD+W")),
                 ("Save", "file.save", Some("CMD+S")),
                 ("Save As…", "file.saveAs", Some("CMD+SHIFT+S")),
+                ("Export as PDF…", "file.exportPdf", None),
                 ("Export as CSV…", "dialog:saveCopy:csv", None),
                 ("Save as Web Page…", "dialog:saveCopy:html", None),
                 ("-", "", None),
@@ -215,6 +216,7 @@ impl NativeMenu {
         ]);
         let _ = menu.append(&app_menu);
         let mut theme_items = Vec::new();
+        let mut window_menu = None;
         for (title, entries) in tree() {
             let sub = Submenu::new(title, true);
             for (label, id, acc) in entries {
@@ -237,8 +239,17 @@ impl NativeMenu {
                 let _ = sub.append(&item);
             }
             let _ = menu.append(&sub);
+            if title == "Window" {
+                window_menu = Some(sub);
+            }
         }
         menu.init_for_nsapp();
+        // NSApp's windowsMenu is where macOS adds Move & Resize, Fill and Center, the targets of the
+        // system tiling shortcuts (Fn+Ctrl+arrows, Fn+F). Only once the menu is NSApp's: muda looks
+        // the submenu up in the installed main menu.
+        if let Some(window) = window_menu {
+            window.set_as_windows_menu_for_nsapp();
+        }
         let (tx, rx) = channel();
         let ctx = ctx.clone();
         MenuEvent::set_event_handler(Some(move |e: MenuEvent| {
@@ -298,6 +309,8 @@ impl NativeMenu {
                 app.open_dialog(name, params);
             } else if id == "edit.copy" || id == "edit.cut" {
                 app.copy_to_clipboard(ctx, &id);
+            } else if id == "edit.paste" {
+                app.paste_from_clipboard();
             } else {
                 app.run_or_alert(&id, json!({}));
             }
@@ -315,6 +328,15 @@ impl NativeMenu {
 mod tests {
     use super::*;
 
+    #[test]
+    fn file_menu_has_export_as_pdf_dispatching_the_command() {
+        let tree = tree();
+        let (_, file) = tree.iter().find(|(title, _)| *title == "File").expect("File menu");
+        let item = file.iter().find(|e| e.0 == "Export as PDF…").expect("Export as PDF… in the File menu");
+        assert_eq!(item.1, "file.exportPdf");
+        assert!(gridcraft_engine::find_command("file.exportPdf").is_some());
+    }
+
     #[test]
     fn theme_choices_use_the_shared_preference_command() {
         let mut app = SheetApp::new(gridcraft_engine::Session::new(), Default::default());

apps/gridcraft/src/print.rs

@@ -0,0 +1,75 @@
+//! Desktop spooler adapter. Discovery and submission never run on the UI thread.
+use gridcraft_ui_egui::printing::{Discover, Duplex, Printer, Settings, Submit};
+
+pub fn discover() -> Discover {
+    Box::new(|| {
+        let (sender, receiver) = std::sync::mpsc::channel();
+        let _ = std::thread::Builder::new().name("print-discovery".into()).spawn(move || {
+            let printers = craft_print::printers().into_iter().map(|printer| Printer { name: printer.name, default: printer.default }).collect();
+            let _ = sender.send(printers);
+        });
+        receiver
+    })
+}
+
+// Keep submission workers reachable until normal app shutdown; dropping a JoinHandle would
+// let process exit kill PowerShell/CUPS before it hands the job to the spooler.
+static JOBS: std::sync::Mutex<Vec<std::thread::JoinHandle<()>>> = std::sync::Mutex::new(Vec::new());
+
+pub fn finish_pending_jobs() {
+    let workers = std::mem::take(&mut *JOBS.lock().unwrap_or_else(|poison| poison.into_inner()));
+    for worker in workers {
+        if worker.join().is_err() {
+            log::error!("the print worker stopped unexpectedly during shutdown");
+        }
+    }
+}
+
+pub fn submit() -> Submit {
+    Box::new(|bytes, settings: Settings| {
+        let (sender, receiver) = std::sync::mpsc::channel();
+        let worker = std::thread::Builder::new().name("print-submit".into()).spawn(move || {
+            let job = craft_print::Job {
+                printer: Some(settings.printer),
+                copies: settings.copies.clamp(1, 999),
+                duplex: settings.duplex.map(|value| match value {
+                    Duplex::LongEdge => craft_print::Duplex::LongEdge,
+                    Duplex::ShortEdge => craft_print::Duplex::ShortEdge,
+                    Duplex::Off => craft_print::Duplex::Off,
+                }),
+                grayscale: settings.grayscale,
+                scaling: craft_print::Scaling::ShrinkToFit,
+                title: "GridCraft document".into(),
+                ..Default::default()
+            };
+            let _ = sender.send(craft_print::submit(&bytes, &job).map_err(|error| error.to_string()));
+        });
+        if let Ok(worker) = worker {
+            let mut jobs = JOBS.lock().unwrap_or_else(|poison| poison.into_inner());
+            jobs.retain(|job| !job.is_finished());
+            jobs.push(worker);
+        }
+        receiver
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    #[test]
+    fn shutdown_waits_for_pending_submission_workers() {
+        let (release, wait) = std::sync::mpsc::channel();
+        let (completed, completion) = std::sync::mpsc::channel();
+        let worker = std::thread::spawn(move || {
+            wait.recv().unwrap();
+            completed.send(()).unwrap();
+        });
+        JOBS.lock().unwrap().push(worker);
+        let shutdown = std::thread::spawn(finish_pending_jobs);
+        assert!(completion.try_recv().is_err(), "the print worker is still pending");
+        release.send(()).unwrap();
+        shutdown.join().unwrap();
+        completion.recv().unwrap();
+        assert!(JOBS.lock().unwrap().is_empty(), "workers were joined before shutdown returned");
+    }
+}

apps/gridcraft/tests/mac_menu_appkit.rs

@@ -0,0 +1,34 @@
+//! The macOS menu bar as AppKit sees it, on the main thread (`harness = false`): install it through
+//! the real muda backend (`src/native_menu.rs`) and read NSApp back. The Window menu must be NSApp's
+//! `windowsMenu`: that is where macOS adds Move & Resize, Fill and Center, the targets of the system
+//! window tiling shortcuts (Fn+Ctrl+arrows, Fn+F), and lists the open windows (#716).
+
+// The app's own module, built into this test (cargo builds harness = false tests with cfg(test), so its
+// unit tests compile here too without a harness to run them).
+#[cfg(target_os = "macos")]
+#[path = "../src/native_menu.rs"]
+#[allow(unused_imports, dead_code)]
+mod native_menu;
+
+#[cfg(target_os = "macos")]
+fn main() {
+    use objc2::MainThreadMarker;
+    use objc2_app_kit::NSApplication;
+
+    let mtm = MainThreadMarker::new().expect("harness = false runs on the main thread");
+    let nsapp = NSApplication::sharedApplication(mtm);
+    nsapp.finishLaunching();
+
+    let ctx = egui::Context::default();
+    let _menu = native_menu::NativeMenu::install(&ctx);
+
+    let bar = nsapp.mainMenu().expect("a main menu");
+    let tops: Vec<String> = (0..bar.numberOfItems()).filter_map(|i| bar.itemAtIndex(i)?.submenu()).map(|m| m.title().to_string()).collect();
+    assert_eq!(tops, ["GridCraft", "File", "Edit", "View", "Insert", "Format", "Tools", "Data", "Window", "Help"]);
+    assert_eq!(nsapp.windowsMenu().map(|m| m.title().to_string()).as_deref(), Some("Window"), "AppKit knows the Window menu");
+
+    println!("mac_menu_appkit: ok");
+}
+
+#[cfg(not(target_os = "macos"))]
+fn main() {}

contributors/people.toml

@@ -54,3 +54,14 @@ sync_github_name = true
 [people.GhostMitra]
 sync_github_name = true
 
+[people.shrshk]
+real_name = "Shirish Veerabattini"
+sync_github_name = true
+[people.jsymes21-byte]
+real_name = "James Symes"
+sync_github_name = true
+
+
+[people.Silvertree2010]
+display_name = "Netter"
+sync_github_name = false

crates/calc/src/eval.rs

@@ -88,6 +88,8 @@ pub struct Evaluator<'h> {
 
 struct FnCtx<'a, 'h> {
     ev: &'a mut Evaluator<'h>,
+    /// The criteria argument of a database function, when it is a reference.
+    criteria: Option<Area>,
 }
 
 impl Ctx for FnCtx<'_, '_> {
@@ -100,6 +102,28 @@ impl Ctx for FnCtx<'_, '_> {
     fn random(&mut self) -> f64 {
         self.ev.host.random()
     }
+    /// Excel's "formula as criteria": the formula is written for the first record, so its relative
+    /// references move down to `record`'s row, and the database's labels name its fields.
+    /// Known gap: the shifted references are not dependencies of the calling cell. One that lands
+    /// outside both the database and the criteria cell's own precedents (say `=G2<H2` with column H
+    /// outside the database) is read here but not tracked, so editing that cell doesn't recalculate
+    /// the D-function until something else does.
+    fn computed_criterion(&mut self, row: usize, col: usize, db: &Array, record: usize) -> Option<bool> {
+        let area = self.criteria?;
+        let at = area.range.start.offset(row as i64, col as i64).filter(|c| area.range.contains(*c))?;
+        let expr = self.ev.host.workbook().sheet(area.sheet)?.cell(at)?.formula.as_ref()?.expr_arc()?;
+        let shifted = gridcraft_formula::adjust::shift_relative((*expr).clone(), record as i64 - 1, 0);
+        let env = (0..db.cols)
+            .filter_map(|c| match db.get(0, c) {
+                Some(Value::Text(t)) if !t.trim().is_empty() => {
+                    Some((t.trim().to_string(), Ev::V(db.get(record, c).cloned().unwrap_or(Value::Empty))))
+                }
+                _ => None,
+            })
+            .collect();
+        let mut ev = Evaluator { host: &mut *self.ev.host, sheet: area.sheet, at, env, depth: self.ev.depth };
+        Some(matches!(ev.value(&shifted).scalar().to_bool(), Ok(true)))
+    }
 }
 
 impl<'h> Evaluator<'h> {
@@ -352,6 +376,9 @@ impl<'h> Evaluator<'h> {
     }
 
     fn unary(&mut self, op: UnOp, x: &Expr) -> Ev {
+        if let UnOp::Trim(mode) = op {
+            return self.trim_ref(mode, x);
+        }
         if op == UnOp::Spill {
             return match self.eval(x) {
                 Ev::R(areas) => match areas.as_slice() {
@@ -380,15 +407,17 @@ impl<'h> Evaluator<'h> {
             };
         }
         let v = self.value(x);
+        let sys = self.host.workbook().date_system;
         Ev::V(map_unary(
             &v,
             &|n| match op {
                 UnOp::Neg => Value::number(-n),
                 UnOp::Plus => Value::number(n),
                 UnOp::Percent => Value::number(n / 100.0),
-                UnOp::At | UnOp::Spill => Value::number(n),
+                UnOp::At | UnOp::Spill | UnOp::Trim(_) => Value::number(n),
             },
             op == UnOp::Plus,
+            sys,
         ))
     }
 
@@ -462,9 +491,22 @@ impl<'h> Evaluator<'h> {
                 }
             }
             _ => {
-                let x = self.value(a);
-                let y = self.value(b);
-                Ev::V(binary_values(op, &x, &y))
+                // A long chain such as A1+A2+…+A500 nests to the left: fold it in a loop instead
+                // of one level of recursion per operator (past the depth limit it was #CALC!).
+                let mut rest = vec![(op, b)];
+                let mut left = a;
+                while let Expr::Binary(o, l, r) = left
+                    && !matches!(o, BinOp::Range | BinOp::Union | BinOp::Intersect)
+                {
+                    rest.push((*o, r.as_ref()));
+                    left = l.as_ref();
+                }
+                let mut acc = self.value(left);
+                while let Some((o, r)) = rest.pop() {
+                    let y = self.value(r);
+                    acc = binary_values(o, &acc, &y, self.host.workbook().date_system);
+                }
+                Ev::V(acc)
             }
         }
     }
@@ -576,7 +618,7 @@ impl<'h> Evaluator<'h> {
                         let value = self.value(a);
                         evaluated.push(Arg { value, from_ref: false });
                     }
-                    let mut ctx = FnCtx { ev: self };
+                    let mut ctx = FnCtx { ev: self, criteria: None };
                     return gridcraft_functions::call(spec, &evaluated, &mut ctx).pipe(Ev::V);
                 }
                 let i = match index.to_number() {
@@ -734,6 +776,20 @@ impl<'h> Evaluator<'h> {
                 Ev::V(Value::Bool(r))
             }
             "MAP" | "REDUCE" | "SCAN" | "BYROW" | "BYCOL" | "MAKEARRAY" => self.higher_order(name, args),
+            "GROUPBY" | "PIVOTBY" => {
+                // The aggregation may be a function given by name (`SUM`): pass it as its name.
+                let i = if name == "GROUPBY" { 2 } else { 3 };
+                match args.get(i).and_then(|a| self.function_by_name(a)) {
+                    Some(f) => {
+                        let mut args = args.to_vec();
+                        if let Some(a) = args.get_mut(i) {
+                            *a = Expr::Text(f.into());
+                        }
+                        self.builtin(name, &args)
+                    }
+                    None => self.builtin(name, args),
+                }
+            }
             "NOW" | "TODAY" | "RAND" | "RANDBETWEEN" | "RANDARRAY" => {
                 self.host.note_volatile();
                 self.builtin(name, args)
@@ -759,8 +815,17 @@ impl<'h> Evaluator<'h> {
         let mut evaluated = Vec::with_capacity(args.len());
         // SUMIF/AVERAGEIF: the size of the criteria range (argument 1), which the sum range takes.
         let mut criteria_shape = None;
+        // Database functions: the criteria range (argument 2), whose formulas are computed criteria.
+        let mut criteria = None;
         for (i, a) in args.iter().enumerate() {
             let mut ev = self.eval(a);
+            if spec.category == gridcraft_functions::Category::Database
+                && i == 2
+                && let Ev::R(areas) = &ev
+                && let [area] = areas.as_slice()
+            {
+                criteria = Some(*area);
+            }
             if resizes_sum_range(name, args.len()) {
                 if i == 0 {
                     criteria_shape = ev_shape(&ev);
@@ -788,7 +853,7 @@ impl<'h> Evaluator<'h> {
             };
             evaluated.push(Arg { value, from_ref });
         }
-        let mut ctx = FnCtx { ev: self };
+        let mut ctx = FnCtx { ev: self, criteria };
         gridcraft_functions::call(spec, &evaluated, &mut ctx).pipe(Ev::V)
     }
 
@@ -842,13 +907,13 @@ impl<'h> Evaluator<'h> {
         };
         let args = [Arg { value, from_ref }];
         if kind != Agg::Count {
-            match gridcraft_functions::call(sum, &args, &mut FnCtx { ev: self }) {
+            match gridcraft_functions::call(sum, &args, &mut FnCtx { ev: self, criteria: None }) {
                 Value::Number(n) => acc.sum += n,
                 other => return Err(Ev::V(other)),
             }
         }
         if kind != Agg::Sum {
-            match gridcraft_functions::call(count, &args, &mut FnCtx { ev: self }) {
+            match gridcraft_functions::call(count, &args, &mut FnCtx { ev: self, criteria: None }) {
                 Value::Number(n) => acc.count = acc.count.saturating_add(n as u64),
                 other => return Err(Ev::V(other)),
             }
@@ -857,7 +922,12 @@ impl<'h> Evaluator<'h> {
     }
 
     pub fn apply_lambda(&mut self, l: &Lambda, args: &[Expr]) -> Ev {
-        if args.len() > l.params.len() {
+        // Too many or too few argument positions is #VALUE!. An explicitly empty position, as in
+        // `(1,)`, is `Expr::Missing` and still counts as a position (it binds as omitted). `f()`
+        // parses to no arguments, which for a one-parameter lambda can also be read as one empty
+        // position, so that call still binds the parameter as omitted.
+        let positions_ok = args.len() == l.params.len() || (args.is_empty() && l.params.len() == 1);
+        if !positions_ok {
             return err(CellError::Value);
         }
         let mut bound = Vec::with_capacity(l.params.len());
@@ -900,7 +970,26 @@ impl<'h> Evaluator<'h> {
         r
     }
 
-    fn lambda_arg(&mut self, e: Option<&Expr>) -> Option<Arc<Lambda>> {
+    /// A worksheet function given by name where a function is expected (`BYROW(A1:C3,SUM)`,
+    /// `GROUPBY(A2:A9,B2:B9,SUM)`): its name, unless a LET/LAMBDA variable or a defined name has
+    /// that name.
+    fn function_by_name(&self, e: &Expr) -> Option<String> {
+        let Expr::Name(n) = e else { return None };
+        if self.env.iter().any(|(k, _)| k.eq_ignore_ascii_case(n)) || self.host.workbook().name(n, self.sheet).is_some() {
+            return None;
+        }
+        let u = n.to_ascii_uppercase();
+        gridcraft_functions::lookup(&u).map(|_| u)
+    }
+
+    /// The function argument of a LAMBDA helper; a function given by name takes `arity`
+    /// arguments.
+    fn lambda_arg(&mut self, e: Option<&Expr>, arity: usize) -> Option<Arc<Lambda>> {
+        if let Some(f) = e.and_then(|x| self.function_by_name(x)) {
+            let params: Vec<String> = (0..arity).map(|i| format!("_xleta.{i}")).collect();
+            let body = Expr::Call(f, params.iter().map(|p| Expr::Name(p.clone())).collect());
+            return Some(Arc::new(Lambda { params, body, env: Vec::new() }));
+        }
         match e.map(|x| self.eval(x)) {
             Some(Ev::L(l)) => Some(l),
             _ => None,
@@ -919,7 +1008,7 @@ impl<'h> Evaluator<'h> {
                 if args.len() < 2 {
                     return err(CellError::Value);
                 }
-                let Some(l) = self.lambda_arg(args.last()) else { return err(CellError::Value) };
+                let Some(l) = self.lambda_arg(args.last(), args.len() - 1) else { return err(CellError::Value) };
                 let arrays: Vec<Arc<Array>> = args[..args.len() - 1].iter().map(|a| as_array(self.value(a))).collect();
                 let rows = arrays.iter().map(|a| a.rows).max().unwrap_or(1);
                 let cols = arrays.iter().map(|a| a.cols).max().unwrap_or(1);
@@ -942,7 +1031,7 @@ impl<'h> Evaluator<'h> {
                 }
                 let mut acc = self.value(&args[0]);
                 let arr = as_array(self.value(&args[1]));
-                let Some(l) = self.lambda_arg(args.get(2)) else { return err(CellError::Value) };
+                let Some(l) = self.lambda_arg(args.get(2), 2) else { return err(CellError::Value) };
                 if l.params.len() != 2 {
                     return err(CellError::Value);
                 }
@@ -966,7 +1055,7 @@ impl<'h> Evaluator<'h> {
                     return err(CellError::Value);
                 }
                 let arr = as_array(self.value(&args[0]));
-                let Some(l) = self.lambda_arg(args.get(1)) else { return err(CellError::Value) };
+                let Some(l) = self.lambda_arg(args.get(1), 1) else { return err(CellError::Value) };
                 let Some(p) = l.params.first().cloned() else { return err(CellError::Value) };
                 let by_row = name == "BYROW";
                 let n = if by_row { arr.rows } else { arr.cols };
@@ -995,7 +1084,7 @@ impl<'h> Evaluator<'h> {
                 if rows < 1.0 || cols < 1.0 || rows * cols > MAX_CELLS as f64 {
                     return err(CellError::Value);
                 }
-                let Some(l) = self.lambda_arg(args.get(2)) else { return err(CellError::Value) };
+                let Some(l) = self.lambda_arg(args.get(2), 2) else { return err(CellError::Value) };
                 if l.params.len() != 2 {
                     return err(CellError::Value);
                 }
@@ -1051,10 +1140,10 @@ impl<'h> Evaluator<'h> {
         if h == 0 || w == 0 {
             return err(CellError::Ref);
         }
-        let r0 = base.range.start.row as i64 + rows;
-        let c0 = base.range.start.col as i64 + cols;
-        let (r0, r1) = if h > 0 { (r0, r0 + h - 1) } else { (r0 + h + 1, r0) };
-        let (c0, c1) = if w > 0 { (c0, c0 + w - 1) } else { (c0 + w + 1, c0) };
+        let r0 = (base.range.start.row as i64).saturating_add(rows);
+        let c0 = (base.range.start.col as i64).saturating_add(cols);
+        let (r0, r1) = if h > 0 { (r0, r0.saturating_add(h - 1)) } else { (r0.saturating_add(h + 1), r0) };
+        let (c0, c1) = if w > 0 { (c0, c0.saturating_add(w - 1)) } else { (c0.saturating_add(w + 1), c0) };
         if r0 < 0 || c0 < 0 || r1 >= MAX_ROWS as i64 || c1 >= MAX_COLS as i64 {
             return err(CellError::Ref);
         }
@@ -1078,8 +1167,18 @@ impl<'h> Evaluator<'h> {
                 v.scalar().to_bool().unwrap_or(true)
             }
         };
-        let text = if a1 { text } else { r1c1_to_a1(&text, self.at).unwrap_or(text) };
+        // With a1 = FALSE, text that isn't R1C1 can still be a name, but never an A1 reference.
+        let (text, a1_ok) = if a1 {
+            (text, true)
+        } else {
+            match r1c1_to_a1(&text, self.at) {
+                Ok(Some(a1_text)) => (a1_text, true),
+                Ok(None) => (text, false),
+                Err(e) => return err(e),
+            }
+        };
         match gridcraft_formula::parse(&text) {
+            Ok(Expr::Ref(_)) if !a1_ok => err(CellError::Ref),
             Ok(e @ (Expr::Ref(_) | Expr::Name(_) | Expr::Struct(_))) => match self.eval(&e) {
                 r @ Ev::R(_) => r,
                 _ => err(CellError::Ref),
@@ -1149,7 +1248,8 @@ impl<'h> Evaluator<'h> {
         }
         match src {
             Ev::R(areas) => {
-                let Some(a) = areas.get((area_n - 1).max(0) as usize).copied() else { return err(CellError::Ref) };
+                let area = usize::try_from((area_n as u64).saturating_sub(1)).ok();
+                let Some(a) = area.and_then(|i| areas.get(i)).copied() else { return err(CellError::Ref) };
                 let r = a.range;
                 // A single row or column with one index picks along it.
                 let (row, col) = if two_args && r.height() == 1 { (1, row) } else { (row, col) };
@@ -1218,7 +1318,7 @@ impl<'h> Evaluator<'h> {
                         }
                     }
                 }
-                let mut ctx = FnCtx { ev: self };
+                let mut ctx = FnCtx { ev: self, criteria: None };
                 return match gridcraft_functions::call(spec, &xargs, &mut ctx) {
                     Value::Number(p) if p >= 1.0 => {
                         let k = p as u32 - 1;
@@ -1272,7 +1372,7 @@ impl<'h> Evaluator<'h> {
                     _ => "v",
                 }))
             }
-            "width" => Ev::V(Value::number(sheet.map_or(8.43, |s| (s.col_width(c.col) as f64 / 7.0 * 100.0).round() / 100.0).round())),
+            "width" => Ev::V(Value::number(sheet.map_or(8.43, |s| gridcraft_model::points_to_chars(s.col_width(c.col) as f64)).round())),
             "filename" => Ev::V(Value::text(String::new())),
             "sheetname" => Ev::V(Value::text(sheet.map(|s| s.name.clone()).unwrap_or_default())),
             "protect" => Ev::V(Value::number(if sheet.is_some_and(|s| wb.styles.get(s.style_id(c)).protection.locked) { 1.0 } else { 0.0 })),
@@ -1287,7 +1387,9 @@ impl<'h> Evaluator<'h> {
     }
 
     fn subtotal(&mut self, name: &str, args: &[Expr]) -> Ev {
-        if args.len() < 2 {
+        // SUBTOTAL needs function_num and ref1; AGGREGATE needs function_num, options and ref1.
+        let min_args = if name == "AGGREGATE" { 3 } else { 2 };
+        if args.len() < min_args {
             return err(CellError::Value);
         }
         let code = match self.arg_num(args, 0, 0.0) {
@@ -1308,8 +1410,12 @@ impl<'h> Evaluator<'h> {
             return err(CellError::Value);
         }
         let skip_hidden = matches!(options, 1 | 3 | 5 | 7);
+        // SUBTOTAL leaves out rows a filter hides whatever the function number (Microsoft's
+        // SUBTOTAL documentation); 101-111 also leave out rows hidden by hand.
+        let skip_filtered = name == "SUBTOTAL";
         let skip_errors = matches!(options, 2 | 3 | 6 | 7);
-        let skip_nested = options <= 3;
+        // SUBTOTAL always leaves out nested SUBTOTAL/AGGREGATE cells (101-111 too); AGGREGATE does so for options 0-3.
+        let skip_nested = name == "SUBTOTAL" || options <= 3;
         let mut values = Vec::new();
         let mut k = None;
         let refs = if name == "AGGREGATE" && func >= 14 { &rest[..1.min(rest.len())] } else { rest };
@@ -1325,7 +1431,8 @@ impl<'h> Evaluator<'h> {
                             let (hidden, nested) = {
                                 let wb = self.host.workbook();
                                 let s = wb.sheet(a.sheet);
-                                let hidden = skip_hidden && s.is_some_and(|s| s.is_row_hidden(c.row));
+                                let hidden =
+                                    s.is_some_and(|s| if skip_hidden { s.is_row_hidden(c.row) } else { skip_filtered && s.is_row_filtered(c.row) });
                                 let nested = skip_nested
                                     && s.and_then(|s| s.cell(c)).and_then(|cell| cell.formula.as_ref()).is_some_and(|f| {
                                         let u = f.text.to_ascii_uppercase();
@@ -1399,37 +1506,42 @@ fn same_kind(a: &Value, b: &Value) -> bool {
     std::mem::discriminant(a) == std::mem::discriminant(b) || (a.is_empty() || b.is_empty())
 }
 
-/// Converts an R1C1 reference text to A1 (for INDIRECT(…, FALSE)).
-pub fn r1c1_to_a1(s: &str, at: CellRef) -> Option<String> {
+/// Converts an R1C1 reference text to A1 (for INDIRECT(…, FALSE)). `Ok(None)` means the text is
+/// not R1C1; `Err` means it is R1C1 but points past the sheet.
+pub fn r1c1_to_a1(s: &str, at: CellRef) -> Result<Option<String>, CellError> {
     let (sheet, body) = match s.rsplit_once('!') {
         Some((sh, b)) => (format!("{sh}!"), b),
         None => (String::new(), s),
     };
-    let conv = |part: &str| -> Option<String> {
+    let conv = |part: &str| -> Result<Option<String>, CellError> {
         let u = part.to_ascii_uppercase();
-        let rest = u.strip_prefix('R')?;
-        let (rpart, cpart) = rest.split_once('C')?;
-        let num = |p: &str, base: u32| -> Option<(u32, bool)> {
-            if p.is_empty() {
-                return Some((base, false));
-            }
-            if let Some(inner) = p.strip_prefix('[').and_then(|x| x.strip_suffix(']')) {
-                let d: i64 = inner.parse().ok()?;
-                let v = base as i64 + d;
-                return if v >= 0 { Some((v as u32, false)) } else { None };
-            }
-            let v: u32 = p.parse().ok()?;
-            Some((v.checked_sub(1)?, true))
+        let Some((rpart, cpart)) = u.strip_prefix('R').and_then(|rest| rest.split_once('C')) else { return Ok(None) };
+        // `None`: not R1C1. `Some(None)`: R1C1, but past the sheet.
+        let num = |p: &str, base: u32, max: u32| -> Option<Option<(u32, bool)>> {
+            let (v, absolute) = if p.is_empty() {
+                (Some(i64::from(base)), false)
+            } else if let Some(inner) = p.strip_prefix('[').and_then(|x| x.strip_suffix(']')) {
+                (i64::from(base).checked_add(inner.parse().ok()?), false)
+            } else {
+                (p.parse::<u32>().ok()?.checked_sub(1).map(i64::from), true)
+            };
+            Some(v.filter(|v| (0..i64::from(max)).contains(v)).map(|v| (v as u32, absolute)))
         };
-        let (r, ra) = num(rpart, at.row)?;
-        let (c, ca) = num(cpart, at.col)?;
-        Some(format!("{}{}{}{}", if ca { "$" } else { "" }, gridcraft_core::col_to_letters(c), if ra { "$" } else { "" }, r + 1))
+        let (Some(r), Some(c)) = (num(rpart, at.row, MAX_ROWS), num(cpart, at.col, MAX_COLS)) else { return Ok(None) };
+        let (Some((r, ra)), Some((c, ca))) = (r, c) else { return Err(CellError::Ref) };
+        Ok(Some(format!("{}{}{}{}", if ca { "$" } else { "" }, gridcraft_core::col_to_letters(c), if ra { "$" } else { "" }, r + 1)))
     };
     let out = match body.split_once(':') {
-        Some((a, b)) => format!("{}:{}", conv(a)?, conv(b)?),
-        None => conv(body)?,
+        Some((a, b)) => match (conv(a)?, conv(b)?) {
+            (Some(a), Some(b)) => format!("{a}:{b}"),
+            _ => return Ok(None),
+        },
+        None => match conv(body)? {
+            Some(x) => x,
+            None => return Ok(None),
+        },
     };
-    Some(format!("{sheet}{out}"))
+    Ok(Some(format!("{sheet}{out}")))
 }
 
 /// The aggregates that can fold a reference without building an array.
@@ -1485,12 +1597,12 @@ impl Acc {
 
 // ---------------------------------------------------------------- operators
 
-fn map_unary(v: &Value, f: &dyn Fn(f64) -> Value, plus: bool) -> Value {
+fn map_unary(v: &Value, f: &dyn Fn(f64) -> Value, plus: bool, sys: gridcraft_core::DateSystem) -> Value {
     match v {
-        Value::Array(a) => Value::from(Array { rows: a.rows, cols: a.cols, data: a.data.iter().map(|x| map_unary(x, f, plus)).collect() }),
+        Value::Array(a) => Value::from(Array { rows: a.rows, cols: a.cols, data: a.data.iter().map(|x| map_unary(x, f, plus, sys)).collect() }),
         Value::Error(e) => Value::Error(*e),
         Value::Text(_) if plus => v.clone(),
-        other => match other.to_number() {
+        other => match other.to_number_in(sys) {
             Ok(n) => f(n),
             Err(e) => Value::Error(e),
         },
@@ -1543,18 +1655,18 @@ fn zip3(c: &Array, t: &Value, f: &Value, g: impl Fn(&Value, &Value, &Value) -> V
     Value::from(Array { rows, cols, data })
 }
 
-pub fn binary_values(op: BinOp, x: &Value, y: &Value) -> Value {
-    zip2(x, y, |a, b| binary_scalar(op, a, b))
+pub fn binary_values(op: BinOp, x: &Value, y: &Value, sys: gridcraft_core::DateSystem) -> Value {
+    zip2(x, y, |a, b| binary_scalar(op, a, b, sys))
 }
 
-fn binary_scalar(op: BinOp, a: &Value, b: &Value) -> Value {
+fn binary_scalar(op: BinOp, a: &Value, b: &Value, sys: gridcraft_core::DateSystem) -> Value {
     if let Value::Error(e) = a {
         return Value::Error(*e);
     }
     if let Value::Error(e) = b {
         return Value::Error(*e);
     }
-    let num = |f: fn(f64, f64) -> Value| match (a.to_number(), b.to_number()) {
+    let num = |f: fn(f64, f64) -> Value| match (a.to_number_in(sys), b.to_number_in(sys)) {
         (Ok(x), Ok(y)) => f(x, y),
         (Err(e), _) | (_, Err(e)) => Value::Error(e),
     };

crates/calc/src/recalc.rs

@@ -6,7 +6,9 @@
 //! O(log n + matches) however many ranges share the column. After an edit, the dirty set is the
 //! transitive closure of dependents; it is evaluated in topological order, with on-demand
 //! evaluation as a safety net for dynamic references. Cycles produce `#CIRC!` unless iterative
-//! calculation is on.
+//! calculation is on: then a formula read while it is being evaluated gives its previous value,
+//! and the formulas that read one are evaluated again until the loop settles
+//! (`PassHost::iterate_loops`).
 
 use std::collections::{BTreeSet, VecDeque};
 use std::hash::{BuildHasherDefault, Hasher};
@@ -58,6 +60,10 @@ const WIDE: u32 = 64;
 /// Insertions an [`Intervals`] keeps aside (scanned by every query) before merging them in.
 const PENDING: usize = 32;
 
+/// Formula evaluations iterative calculation may spend on one recalculation (passes × formulas
+/// evaluated again), however high Maximum Iterations is.
+const MAX_ITERATION_WORK: usize = 10_000_000;
+
 /// Row intervals `[r0, r1]`, each with a payload, answering "which intervals overlap rows
 /// `a..=b`?" in O(log n + k).
 ///
@@ -389,6 +395,44 @@ struct PassHost<'a> {
     cycle: bool,
     cycles: Vec<Key>,
     depth: usize,
+    /// Iterative calculation: a circular reference reads the cell's previous value instead of
+    /// giving `#CIRC!`.
+    iterate: bool,
+    /// Values from the previous iteration; cells not in it read their stored value.
+    prev: HashMap<Key, Value>,
+    /// Formulas being evaluated, innermost last (kept only when iterating).
+    stack: Vec<Key>,
+    /// Formulas found on a circular reference (when iterating).
+    members: HashSet<Key>,
+    /// Results that read a previous value, directly or through other formulas.
+    tainted: HashSet<Key>,
+    /// Whether the formula being evaluated has read a previous value.
+    taint: bool,
+}
+
+impl<'a> PassHost<'a> {
+    fn new(wb: &'a Workbook, exprs: &'a HashMap<Key, std::sync::Arc<Expr>>, rng: &'a mut u64, now: f64) -> Self {
+        PassHost {
+            wb,
+            exprs,
+            results: HashMap::with_capacity_and_hasher(exprs.len(), Default::default()),
+            pending: exprs.keys().copied().collect(),
+            in_progress: HashSet::default(),
+            spills: HashMap::default(),
+            used: HashMap::default(),
+            rng,
+            now,
+            cycle: false,
+            cycles: vec![],
+            depth: 0,
+            iterate: false,
+            prev: HashMap::default(),
+            stack: Vec::new(),
+            members: HashSet::default(),
+            tainted: HashSet::default(),
+            taint: false,
+        }
+    }
 }
 
 /// Whether an array result at `k` can't spill: it is in a table, or its area runs off the sheet,
@@ -415,18 +459,29 @@ fn spill_blocked(host: &PassHost<'_>, (sheet, anchor): Key, a: &Array) -> bool {
 impl PassHost<'_> {
     fn compute(&mut self, k: Key) -> Value {
         if let Some(v) = self.results.get(&k) {
-            return v.clone();
+            let v = v.clone();
+            if self.iterate && self.tainted.contains(&k) {
+                self.taint = true;
+            }
+            return v;
         }
         let Some(expr) = self.exprs.get(&k) else {
             return self.wb.sheet(k.0).map(|s| s.value(k.1)).unwrap_or_default();
         };
         if self.in_progress.contains(&k) || self.depth > 2000 {
             self.cycle = true;
+            if self.iterate {
+                return self.circular_read(k);
+            }
             self.cycles.push(k);
             return Value::Error(CellError::Circ);
         }
         self.in_progress.insert(k);
         self.depth += 1;
+        let outer_taint = std::mem::replace(&mut self.taint, false);
+        if self.iterate {
+            self.stack.push(k);
+        }
         let expr = std::sync::Arc::clone(expr);
         let v = {
             let mut ev = Evaluator::new(self, k.0, k.1);
@@ -441,6 +496,15 @@ impl PassHost<'_> {
         self.depth -= 1;
         self.in_progress.remove(&k);
         self.pending.remove(&k);
+        if self.iterate {
+            self.stack.pop();
+            if self.taint {
+                self.tainted.insert(k);
+            } else {
+                self.tainted.remove(&k);
+            }
+        }
+        self.taint |= outer_taint;
         // A blank cell shows as 0 in a formula's result, inside an array as well (`=A1:A3`,
         // FILTER or SORT of a range with blanks). GROUPBY and PIVOTBY lay out blank cells
         // of their own, which stay blank.
@@ -472,6 +536,68 @@ impl PassHost<'_> {
         self.results.insert(k, v.clone());
         v
     }
+
+    /// A formula's previous value for iterative calculation: from the last iteration, else the
+    /// value it shows. Blank, and the `#CIRC!` of a loop calculated with iteration off, are 0.
+    fn previous(&self, k: Key) -> Value {
+        let v = match self.prev.get(&k) {
+            Some(v) => v.clone(),
+            None => self.wb.sheet(k.0).map(|s| s.value(k.1)).unwrap_or_default(),
+        };
+        if matches!(v, Value::Empty | Value::Error(CellError::Circ)) { Value::Number(0.0) } else { v }
+    }
+
+    /// Reading `k` while it is being evaluated, with iterative calculation on: its previous value.
+    /// The formulas around the loop are the ones whose changes decide when iteration stops.
+    fn circular_read(&mut self, k: Key) -> Value {
+        self.taint = true;
+        match self.stack.iter().rposition(|s| *s == k) {
+            Some(i) => self.members.extend(self.stack.get(i..).unwrap_or_default().iter().copied()),
+            // Too deep to follow: the formula itself is watched.
+            None => {
+                self.members.insert(k);
+            }
+        }
+        self.previous(k)
+    }
+
+    /// Iterative calculation, after a first pass over `order` that met circular references. The
+    /// formulas that read a previous value (the loops and what depends on them) are evaluated
+    /// again in the same order, each pass starting from the last one's values and reading what it
+    /// has already produced (Gauss-Seidel), until no formula on a loop changes by `max_change` or
+    /// more, or after `max_iterations` passes in all. Returns the number of passes.
+    fn iterate_loops(&mut self, order: &[Key], max_iterations: u32, max_change: f64) -> u32 {
+        let again: Vec<Key> = order.iter().copied().filter(|k| self.tainted.contains(k)).collect();
+        let set: HashSet<Key> = again.iter().copied().collect();
+        // Bounds the work whatever Maximum Iterations says.
+        let max_passes = u32::try_from(MAX_ITERATION_WORK / again.len().max(1)).unwrap_or(u32::MAX).max(1);
+        let mut passes = 1u32;
+        while passes < max_iterations.min(max_passes) && !self.converged(max_change) {
+            self.prev = again.iter().filter_map(|k| self.results.remove(k).map(|v| (*k, v))).collect();
+            self.pending = set.clone();
+            self.spills.retain(|a, _| !set.contains(a));
+            for k in &again {
+                self.compute(*k);
+            }
+            passes += 1;
+        }
+        passes
+    }
+
+    /// Whether every formula on a loop changed by less than `max_change` in the last pass (text,
+    /// logical and error values: not at all).
+    fn converged(&self, max_change: f64) -> bool {
+        self.members.iter().all(|k| {
+            let Some(new) = self.results.get(k) else { return true };
+            match (new, &self.previous(*k)) {
+                (Value::Number(a), Value::Number(b)) => {
+                    let d = (a - b).abs();
+                    d < max_change || d == 0.0
+                }
+                (new, old) => new == old,
+            }
+        })
+    }
 }
 
 /// A legacy (Ctrl+Shift+Enter) array formula's result fitted to the range it was entered in, as
@@ -532,6 +658,9 @@ impl Host for PassHost<'_> {
             if anchor.0 == sheet && c.row >= anchor.1.row && c.col >= anchor.1.col {
                 let (dr, dc) = ((c.row - anchor.1.row) as usize, (c.col - anchor.1.col) as usize);
                 if dr < arr.rows && dc < arr.cols {
+                    if self.iterate && self.tainted.contains(anchor) {
+                        self.taint = true;
+                    }
                     return arr.get(dr, dc).cloned().unwrap_or_default();
                 }
             }
@@ -590,6 +719,18 @@ impl Host for PassHost<'_> {
                     v
                 })
                 .collect();
+            // Iterating: an array spilled by a formula that read a previous value.
+            if self.iterate
+                && self.spills.iter().any(|(a, arr)| {
+                    let end = CellRef::new(
+                        a.1.row.saturating_add((arr.rows as u32).saturating_sub(1)),
+                        a.1.col.saturating_add((arr.cols as u32).saturating_sub(1)),
+                    );
+                    a.0 == sheet && self.tainted.contains(a) && RangeRef::new(a.1, end).intersects(&range)
+                })
+            {
+                self.taint = true;
+            }
             for (i, v) in new {
                 if let Some(slot) = out.get_mut(i) {
                     *slot = v;
@@ -757,11 +898,11 @@ impl Calc {
         // Spill areas of changed anchors also change.
         for &k in changed {
             if let Some(r) = wb.sheet(k.0).and_then(|s| s.spill_ranges.get(&k.1)) {
-                seeds.extend(r.iter().take(65536).map(|c| (k.0, c)));
+                seeds.extend(r.iter().map(|c| (k.0, c)));
             }
         }
         for (si, r) in &cleared {
-            seeds.extend(r.iter().take(65536).map(|c| (*si, c)));
+            seeds.extend(r.iter().map(|c| (*si, c)));
         }
         let t0 = prof_now();
         let dirty = self.dirty_closure(wb, &seeds);
@@ -825,23 +966,17 @@ impl Calc {
             let mut rng = self.rng;
             let tp = prof_now();
             let (results, spills, cycles) = {
-                let mut host = PassHost {
-                    wb,
-                    exprs: &exprs,
-                    results: HashMap::with_capacity_and_hasher(dirty.len(), Default::default()),
-                    pending: exprs.keys().copied().collect(),
-                    in_progress: HashSet::default(),
-                    spills: HashMap::default(),
-                    used: HashMap::default(),
-                    rng: &mut rng,
-                    now,
-                    cycle: false,
-                    cycles: vec![],
-                    depth: 0,
-                };
+                let mut host = PassHost::new(wb, &exprs, &mut rng, now);
+                host.iterate = wb.calc.iterative;
                 for k in &dirty {
                     host.compute(*k);
                 }
+                if host.iterate && !host.members.is_empty() {
+                    let passes = host.iterate_loops(&dirty, wb.calc.max_iterations, wb.calc.max_change);
+                    if std::env::var_os("GRIDCRAFT_PROFILE").is_some() {
+                        eprintln!("  iterative calculation: {} passes over {} formulas", passes, host.tainted.len());
+                    }
+                }
                 (host.results, host.spills, host.cycles)
             };
             self.rng = rng;
@@ -961,20 +1096,7 @@ pub fn evaluate(wb: &Workbook, sheet: usize, at: CellRef, formula: &str) -> Valu
 pub fn evaluate_expr(wb: &Workbook, sheet: usize, at: CellRef, expr: &Expr) -> Value {
     let exprs = HashMap::default();
     let mut rng = 0x1234_5678_9ABC_DEF0u64;
-    let mut host = PassHost {
-        wb,
-        exprs: &exprs,
-        results: HashMap::default(),
-        pending: HashSet::default(),
-        in_progress: HashSet::default(),
-        spills: HashMap::default(),
-        used: HashMap::default(),
-        rng: &mut rng,
-        now: now_serial(),
-        cycle: false,
-        cycles: vec![],
-        depth: 0,
-    };
+    let mut host = PassHost::new(wb, &exprs, &mut rng, now_serial());
     let mut ev = Evaluator::new(&mut host, sheet, at);
     ev.value(expr)
 }
@@ -998,7 +1120,7 @@ pub(crate) mod tests {
     use gridcraft_core::{CellRef, RangeRef, Value};
     use gridcraft_model::{Cell, Formula, Workbook};
 
-    use super::{Calc, HashMap, HashSet, Host, Intervals, Key, PassHost};
+    use super::{Calc, HashMap, Host, Intervals, Key, PassHost};
 
     /// xorshift64 for repeatable pseudo-random cases.
     fn rng(state: &mut u64) -> u64 {
@@ -1214,20 +1336,7 @@ pub(crate) mod tests {
         // of a real pass partway through; `visit_range` has to cope with the formulas it reads
         // being calculated under it.
         let mut rng = 1u64;
-        let mut host = PassHost {
-            wb,
-            pending: exprs.keys().copied().collect(),
-            exprs: &exprs,
-            results: HashMap::default(),
-            in_progress: HashSet::default(),
-            spills: HashMap::default(),
-            used: HashMap::default(),
-            rng: &mut rng,
-            now: 0.0,
-            cycle: false,
-            cycles: vec![],
-            depth: 0,
-        };
+        let mut host = PassHost::new(wb, &exprs, &mut rng, 0.0);
 
         let mut seen = Vec::new();
         host.visit_range(0, range, &mut |v| {

crates/calc/src/tests.rs

@@ -157,6 +157,21 @@ fn index_with_arrays_of_positions() {
     assert_eq!(t.num("E7"), 6.0);
 }
 
+#[test]
+fn index_area_number_overflow() {
+    let mut t = T::new();
+    t.set("A1", "7");
+    t.set("D1", "9");
+    for (area, expected) in [("1", 7.0), ("2", 9.0)] {
+        t.set("G5", &format!("=INDEX((A1:B2,D1:E2),1,1,{area})"));
+        assert_eq!(t.num("G5"), expected, "area {area}");
+    }
+    for area in ["3", "1E300", "-1", "-1E300"] {
+        t.set("G5", &format!("=INDEX((A1:B2,D1:E2),1,1,{area})"));
+        assert_eq!(t.get("G5"), Value::Error(CellError::Ref), "area {area}");
+    }
+}
+
 #[test]
 fn errors_and_cycles() {
     let mut t = T::new();
@@ -167,10 +182,134 @@ fn errors_and_cycles() {
     assert!(t.get("B1").is_error());
     t.set("C1", "=NOSUCHFN(1)");
     assert_eq!(t.get("C1"), Value::Error(CellError::Name));
+    // `_xludf.` marks a user-defined function, never the built-in of the same name (#726).
+    for f in ["=_xludf.CONCAT(\"a\",\"b\")", "=_xludf.SUM(1,2)", "=_xludf.EOMONTH()"] {
+        t.set("C3", f);
+        assert_eq!(t.get("C3"), Value::Error(CellError::Name), "{f}");
+    }
     t.set("C2", "=1+");
     assert_eq!(t.get("C2"), Value::Error(CellError::Name));
 }
 
+impl T {
+    fn iterative(max_iterations: u32, max_change: f64) -> T {
+        let mut t = T::new();
+        t.wb.calc.iterative = true;
+        t.wb.calc.set_max_iterations(max_iterations);
+        t.wb.calc.set_max_change(max_change);
+        t
+    }
+}
+
+#[test]
+fn iterative_calculation_stops_at_maximum_iterations() {
+    // A1 =A1+1 never settles: every recalculation adds Maximum Iterations.
+    let mut t = T::iterative(100, 0.001);
+    t.set("A1", "=A1+1");
+    assert_eq!(t.num("A1"), 100.0);
+    assert!(t.calc.circular.is_empty());
+    // An edit outside the loop doesn't recalculate it.
+    t.set("B1", "7");
+    assert_eq!(t.num("A1"), 100.0);
+    // Each recalculation starts from the value the cell shows.
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.num("A1"), 200.0);
+    t.wb.calc.set_max_iterations(5);
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.num("A1"), 205.0);
+    // Through a range that holds the formula itself.
+    t.set("C1", "1");
+    t.set("C2", "2");
+    t.set("C3", "=SUM(C1:C3)");
+    assert_eq!(t.num("C3"), 15.0);
+    // Excel's largest Maximum Iterations.
+    let mut t = T::iterative(32767, 0.001);
+    t.set("A1", "=A1+1");
+    assert_eq!(t.num("A1"), 32767.0);
+}
+
+#[test]
+fn iterative_calculation_converges_within_maximum_change() {
+    let mut t = T::iterative(100, 0.001);
+    t.set("A1", "=(A2+10)/2");
+    t.set("A2", "=A1");
+    assert!((t.num("A1") - 10.0).abs() < 0.002, "{}", t.num("A1"));
+    assert!((t.num("A2") - 10.0).abs() < 0.002, "{}", t.num("A2"));
+    assert!(t.calc.circular.is_empty());
+    // A loop fed by a constant, and a formula that reads the loop, follow a change.
+    t.set("D1", "10");
+    t.set("A1", "=(A2+D1)/2");
+    t.set("E1", "=A1*2");
+    t.set("D1", "30");
+    assert!((t.num("A1") - 30.0).abs() < 0.002, "{}", t.num("A1"));
+    assert!((t.num("E1") - 60.0).abs() < 0.004, "{}", t.num("E1"));
+    // Already settled: recalculating changes it by less than Maximum Change.
+    let a1 = t.num("A1");
+    t.calc.recalc_all(&mut t.wb);
+    assert!((t.num("A1") - a1).abs() < 0.001);
+}
+
+#[test]
+fn iterative_calculation_stops_once_changes_are_below_maximum_change() {
+    // A1 halves its distance to 10 each pass, from 5: 7.5, 8.75, 9.375, 9.6875, and A2 trails
+    // one pass behind. Maximum Change 1 stops once neither moved by 1 or more.
+    let mut t = T::iterative(100, 1.0);
+    t.set("A1", "=(A2+10)/2");
+    assert_eq!(t.num("A1"), 5.0);
+    t.set("A2", "=A1");
+    assert_eq!((t.num("A1"), t.num("A2")), (9.6875, 9.375));
+    // Maximum Iterations 2 stops first.
+    let mut t = T::iterative(2, 1.0);
+    t.set("A1", "=(A2+10)/2");
+    t.set("A2", "=A1");
+    assert_eq!((t.num("A1"), t.num("A2")), (8.75, 7.5));
+}
+
+#[test]
+fn iterative_calculation_of_text_and_errors() {
+    let mut t = T::iterative(100, 0.001);
+    t.set("A1", "=IF(ISTEXT(A1),A1&\"\",\"go\")");
+    assert_eq!(t.get("A1"), Value::from("go"));
+    t.set("B1", "=B1+1/0");
+    assert_eq!(t.get("B1"), Value::Error(CellError::Div0));
+}
+
+#[test]
+fn circular_references_without_iterative_calculation() {
+    let mut t = T::new();
+    t.set("A1", "=A1+1");
+    assert_eq!(t.get("A1"), Value::Error(CellError::Circ));
+    assert_eq!(t.calc.circular, vec![(0, c("A1"))]);
+    // Switched on, the loop is calculated from 0 rather than from the error.
+    t.wb.calc.iterative = true;
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.num("A1"), 100.0);
+    assert!(t.calc.circular.is_empty());
+    t.wb.calc.iterative = false;
+    t.calc.recalc_all(&mut t.wb);
+    assert_eq!(t.get("A1"), Value::Error(CellError::Circ));
+}
+
+#[test]
+fn date_text_coerces_in_the_workbook_date_system() {
+    for (sys, serial) in [(gridcraft_core::DateSystem::D1900, 1462.0), (gridcraft_core::DateSystem::D1904, 0.0)] {
+        let mut t = T::new();
+        t.wb.date_system = sys;
+        t.set("A1", "'1/1/1904");
+        t.set("B1", "=A1+0");
+        t.set("C1", "=VALUE(A1)");
+        t.set("D1", "=-A1");
+        t.set("E1", "=DATEVALUE(A1)");
+        t.set("F1", "=NUMBERVALUE(A1)");
+        assert_eq!(t.get("A1"), Value::from("1/1/1904"));
+        assert_eq!(t.num("B1"), serial, "{sys:?}");
+        assert_eq!(t.num("C1"), serial, "{sys:?}");
+        assert_eq!(t.num("D1"), -serial, "{sys:?}");
+        assert_eq!(t.num("E1"), serial, "{sys:?}");
+        assert_eq!(t.num("F1"), serial, "{sys:?}");
+    }
+}
+
 #[test]
 fn operators() {
     let mut t = T::new();
@@ -246,6 +385,9 @@ fn arrays_do_not_spill_in_tables() {
         first_col: false,
         last_col: false,
         filter_button: false,
+        filter: vec![],
+        table_type: None,
+        connection_id: None,
     });
     t.set("C4", "=SEQUENCE(2)");
     t.set("E1", "=SEQUENCE(4)");
@@ -303,6 +445,22 @@ fn references_functions() {
     assert_eq!(t.num("B3"), 50.0);
     t.set("B4", "=INDIRECT(\"A\"&4)");
     assert_eq!(t.num("B4"), 40.0);
+    // With a1 = FALSE the text must be R1C1: A1-style text is #REF!, not read as A1.
+    t.set("C1", "=INDIRECT(\"R3C1\",FALSE)");
+    assert_eq!(t.num("C1"), 30.0);
+    t.set("C2", "=INDIRECT(\"A3\",FALSE)");
+    assert_eq!(t.get("C2"), Value::Error(CellError::Ref));
+    // Defined names don't depend on the reference style.
+    t.wb.names.push(gridcraft_model::DefinedName {
+        name: "Third".into(),
+        scope: None,
+        formula: "Sheet1!$A$3".into(),
+        comment: String::new(),
+        hidden: false,
+    });
+    t.calc.rebuild(&t.wb);
+    t.set("C3", "=INDIRECT(\"Third\",FALSE)");
+    assert_eq!(t.num("C3"), 30.0);
     t.set("B5", "=SUM(A1:INDEX(A1:A4,3))");
     assert_eq!(t.num("B5"), 60.0);
     t.set("B6", "=SUM(A:A)");
@@ -312,6 +470,37 @@ fn references_functions() {
     assert_eq!(t.num("B6"), 105.0);
 }
 
+#[test]
+fn indirect_r1c1_out_of_bounds() {
+    for reference in ["R[9223372036854775807]C", "RC[9223372036854775807]", "R[4294967296]C", "R[4294967291]C", "R[2000000]C", "RC[20000]"] {
+        let mut t = T::new();
+        t.set("D5", &format!("=ROW(INDIRECT(\"{reference}\",FALSE))"));
+        assert_eq!(t.get("D5"), Value::Error(CellError::Ref), "{reference}");
+    }
+}
+
+#[test]
+fn indirect_r1c1_past_the_sheet_does_not_fall_back_to_a1() {
+    let mut t = T::new();
+    t.set("RC16385", "78");
+    for reference in ["RC16385", "rc16385", "RC1:RC16385"] {
+        t.set("D5", &format!("=INDIRECT(\"{reference}\",FALSE)"));
+        assert_eq!(t.get("D5"), Value::Error(CellError::Ref), "{reference}");
+    }
+}
+
+#[test]
+fn indirect_r1c1_valid_references() {
+    let mut t = T::new();
+    t.set("E6", "11");
+    t.set("A1", "22");
+    t.set("D4", "33");
+    for (reference, expected) in [("R[1]C[1]", 11.0), ("R1C1", 22.0), ("R[-1]C", 33.0)] {
+        t.set("D5", &format!("=INDIRECT(\"{reference}\",FALSE)"));
+        assert_eq!(t.num("D5"), expected, "{reference}");
+    }
+}
+
 #[test]
 fn relative_names() {
     let mut t = T::new();
@@ -401,6 +590,59 @@ fn let_lambda() {
     assert_eq!(t.num("A4"), 14.0);
 }
 
+#[test]
+fn functions_given_by_name() {
+    let mut t = T::new();
+    for (i, (k, v)) in [("a", 1), ("b", -2), ("a", 3)].iter().enumerate() {
+        t.set(&format!("A{}", i + 1), k);
+        t.set(&format!("B{}", i + 1), &v.to_string());
+    }
+    t.set("D1", "=BYROW(B1:B3,SUM)");
+    assert_eq!(t.num("D2"), -2.0);
+    t.set("E1", "=MAP(B1:B3,ABS)");
+    assert_eq!(t.num("E2"), 2.0);
+    t.set("F1", "=REDUCE(0,B1:B3,SUM)");
+    assert_eq!(t.num("F1"), 2.0);
+    t.set("G1", "=GROUPBY(A1:A3,B1:B3,SUM,0,0)");
+    assert_eq!(t.get("G1"), Value::from("a"));
+    assert_eq!(t.num("H1"), 4.0);
+    // A LET variable of that name is still the variable.
+    t.set("J1", "=LET(ABS,LAMBDA(x,x*10),SUM(MAP(B1:B3,ABS)))");
+    assert_eq!(t.num("J1"), 20.0);
+}
+
+#[test]
+fn lambda_argument_count() {
+    let mut t = T::new();
+    t.wb.names.push(gridcraft_model::DefinedName {
+        name: "AddPair".into(),
+        scope: None,
+        formula: "LAMBDA(a,b,a+b)".into(),
+        comment: String::new(),
+        hidden: false,
+    });
+    t.calc.rebuild(&t.wb);
+    let omit = "LAMBDA(x,y,IF(ISOMITTED(y),\"Missing\",x+y))";
+    t.set("A1", "=LAMBDA(a,b,a+b)(2)");
+    t.set("A2", "=LAMBDA(a,b,a+b)(2,3,4)");
+    t.set("A3", &format!("={omit}(1,)"));
+    t.set("A4", &format!("={omit}(1)"));
+    t.set("A5", &format!("={omit}(1,2)"));
+    t.set("A6", "=LAMBDA(7)()");
+    t.set("A7", "=AddPair(2)");
+    t.set("A8", "=AddPair(2,3)");
+    assert_eq!(t.get("A1"), Value::Error(CellError::Value));
+    assert_eq!(t.get("A2"), Value::Error(CellError::Value));
+    assert_eq!(t.get("A3"), Value::Text("Missing".into()));
+    assert_eq!(t.get("A4"), Value::Error(CellError::Value));
+    assert_eq!(t.num("A5"), 3.0);
+    assert_eq!(t.num("A6"), 7.0);
+    assert_eq!(t.get("A7"), Value::Error(CellError::Value));
+    assert_eq!(t.num("A8"), 5.0);
+    t.set("A9", "=LAMBDA(x,ISOMITTED(x))()");
+    assert_eq!(t.get("A9"), Value::Bool(true));
+}
+
 #[test]
 fn names_and_sheets() {
     let mut t = T::new();
@@ -449,6 +691,17 @@ fn text_function() {
     assert_eq!(t.get("A1"), Value::from("1,234.50"));
 }
 
+#[test]
+fn long_operator_chains() {
+    let mut t = T::new();
+    t.set("A1", "1");
+    // 1,000 additions: a formula of 3,000 characters, well within Excel's 8,192.
+    t.set("B1", &format!("={}", vec!["A1"; 1000].join("+")));
+    assert_eq!(t.num("B1"), 1000.0);
+    t.set("B2", &format!("=5{}", "+1-1".repeat(600)));
+    assert_eq!(t.num("B2"), 5.0);
+}
+
 #[test]
 fn subtotal_skips_hidden() {
     let mut t = T::new();
@@ -462,6 +715,101 @@ fn subtotal_skips_hidden() {
     assert_eq!(t.num("B2"), 6.0);
 }
 
+#[test]
+fn subtotal_109_skips_nested_subtotal() {
+    let mut t = T::new();
+    t.set("A1", "2");
+    t.set("A2", "=SUBTOTAL(9,A1)");
+    t.set("C1", "=SUBTOTAL(109,A1:A2)");
+    t.set("C2", "=SUBTOTAL(9,A1:A2)");
+    t.set("C3", "=SUBTOTAL(109,A1)");
+    assert_eq!(t.num("C1"), 2.0);
+    assert_eq!(t.num("C2"), 2.0);
+    assert_eq!(t.num("C3"), 2.0);
+    // Manually hidden rows are still left out by 109 only.
+    let mut t = T::new();
+    t.set("A1", "1");
+    t.set("A2", "2");
+    t.set("A3", "=SUBTOTAL(9,A1:A2)");
+    t.wb.sheet_mut(0).unwrap().rows.insert(1, gridcraft_model::LineInfo { hidden: true, ..Default::default() });
+    t.set("B1", "=SUBTOTAL(109,A1:A3)");
+    t.set("B2", "=SUBTOTAL(9,A1:A3)");
+    assert_eq!(t.num("B1"), 1.0);
+    assert_eq!(t.num("B2"), 3.0);
+}
+
+/// SUBTOTAL leaves out rows a filter hides for every function number, while 1-11 keep rows
+/// hidden by hand (as in ConditionalFormattingSamples.xlsx, where `SUBTOTAL(9,Table69[Sales])`
+/// under a filtered table adds only the visible rows).
+#[test]
+fn subtotal_skips_filtered_rows() {
+    use gridcraft_model::{AutoFilter, FilterCriterion, LineInfo};
+    let mut t = T::new();
+    for (i, v) in [1, 2, 4, 8, 16, 32].iter().enumerate() {
+        t.set(&format!("A{}", i + 2), &v.to_string());
+        t.set(&format!("C{}", i + 2), &v.to_string());
+    }
+    let crit = || vec![(0, FilterCriterion::Custom { a: (">".into(), "1".into()), b: None, and: false })];
+    let sh = t.wb.sheet_mut(0).unwrap();
+    sh.tables.push(gridcraft_model::Table {
+        id: 1,
+        name: "Sales".into(),
+        range: gridcraft_core::RangeRef::parse("A1:A7").unwrap(),
+        header_row: true,
+        totals_row: false,
+        columns: vec![gridcraft_model::TableColumn {
+            name: "Amount".into(),
+            totals: Default::default(),
+            totals_label: None,
+            formula: None,
+            unique_name: None,
+            xml: None,
+        }],
+        style: String::new(),
+        banded_rows: false,
+        banded_cols: false,
+        first_col: false,
+        last_col: false,
+        filter_button: true,
+        filter: crit(),
+        table_type: None,
+        connection_id: None,
+    });
+    sh.autofilter = Some(AutoFilter { range: gridcraft_core::RangeRef::parse("C1:C7").unwrap(), criteria: crit() });
+    // Rows 3 and 5 are filtered out; row 9 (outside both filters) is hidden by hand.
+    for row in [2, 4, 8] {
+        sh.rows.insert(row, LineInfo { hidden: true, ..Default::default() });
+    }
+    t.set("A9", "64");
+    t.set("E1", "=SUBTOTAL(9,Sales[Amount])");
+    t.set("E2", "=SUBTOTAL(109,Sales[Amount])");
+    t.set("E3", "=SUBTOTAL(9,C2:C7)");
+    t.set("E4", "=SUBTOTAL(9,A2:A9)");
+    t.set("E5", "=SUBTOTAL(109,A2:A9)");
+    t.set("E6", "=SUBTOTAL(2,A2:A7)");
+    t.set("E7", "=AGGREGATE(9,4,A2:A7)");
+    for (at, want) in [("E1", 53.0), ("E2", 53.0), ("E3", 53.0), ("E4", 117.0), ("E5", 53.0), ("E6", 4.0), ("E7", 63.0)] {
+        assert_eq!(t.num(at), want, "{at}");
+    }
+}
+
+#[test]
+fn aggregate_without_data_argument_is_an_error() {
+    let mut t = T::new();
+    t.set("A1", "1");
+    t.set("A2", "2");
+    t.set("D1", "=AGGREGATE(9,0)");
+    t.set("D2", "=AGGREGATE(4,0)");
+    t.set("D3", "=AGGREGATE(9,0,A1:A2)");
+    t.set("D4", "=AGGREGATE(9,0,A3:A4)");
+    t.set("D5", "=AGGREGATE(9,0,A1:A2,A1:A2)");
+    assert_eq!(t.get("D1"), Value::Error(CellError::Value));
+    assert_eq!(t.get("D2"), Value::Error(CellError::Value));
+    assert_eq!(t.num("D3"), 3.0);
+    assert_eq!(t.num("D4"), 0.0);
+    assert_eq!(t.num("D5"), 6.0);
+}
+
 #[test]
 fn recalc_all_after_load() {
     let mut t = T::new();
@@ -783,3 +1131,138 @@ fn visit_range_declines_when_a_formula_in_the_block_spills_into_it() {
 
     assert_eq!(walked, None, "walked a block holding a spill it can't see");
 }
+
+/// Trim references evaluate as `TRIMRANGE(range, code, code)`.
+#[test]
+fn trim_references() {
+    let mut t = T::new();
+    t.set("C3", "1");
+    t.set("D5", "2");
+    t.set("A20", "5");
+    t.set("A21", "6");
+    let cases = [
+        ("J1", "=ROWS(A1.:.F10)", "=ROWS(TRIMRANGE(A1:F10,3,3))", 3.0),
+        ("J2", "=COLUMNS(A1.:.F10)", "=COLUMNS(TRIMRANGE(A1:F10,3,3))", 2.0),
+        ("J3", "=ROWS(A1:.F10)", "=ROWS(TRIMRANGE(A1:F10,2,2))", 5.0),
+        ("J4", "=COLUMNS(A1:.F10)", "=COLUMNS(TRIMRANGE(A1:F10,2,2))", 4.0),
+        ("J5", "=ROWS(A1.:F10)", "=ROWS(TRIMRANGE(A1:F10,1,1))", 8.0),
+        ("J6", "=MIN(ROW(A1.:F10))", "=MIN(ROW(TRIMRANGE(A1:F10,1,1)))", 3.0),
+        ("J7", "=SUM(A:.A)", "=SUM(TRIMRANGE(A:A,2,2))", 11.0),
+        ("J8", "=ROWS(A:.A)", "=ROWS(TRIMRANGE(A:A,2,2))", 21.0),
+        ("J9", "=ROWS(A.:.A)", "=ROWS(TRIMRANGE(A:A,3,3))", 2.0),
+        ("J10", "=ROWS(20.:.30)", "=ROWS(TRIMRANGE(20:30,3,3))", 2.0),
+    ];
+    for (at, f, _, _) in cases {
+        t.set(at, f);
+    }
+    for (i, (at, f, same, want)) in cases.iter().enumerate() {
+        assert_eq!(t.num(at), *want, "{f}");
+        let k = format!("K{}", i + 1);
+        t.set(&k, same);
+        assert_eq!(t.num(&k), *want, "{same}");
+    }
+    // The trimmed block spills and follows edits to the full range.
+    t.set("L1", "=C1.:.F10");
+    assert_eq!((t.num("L1"), t.num("M3")), (1.0, 2.0));
+    t.set("A22", "4");
+    assert_eq!((t.num("J7"), t.num("J8")), (15.0, 22.0));
+    // Nothing but blanks.
+    t.set("K20", "=SUM(Q1:.Q9)");
+    assert_eq!(t.get("K20"), Value::Error(CellError::Calc));
+}
+
+#[test]
+fn cell_width_is_the_column_width_dialog_value_rounded() {
+    // #735: Excel 365 values. Widths in px as `home.columnWidth {"chars"}` sets them
+    // (chars * 7 + 5): 10.71 -> 80, 12 -> 89, 10.57 -> 79, 2.86 -> 25; B keeps the default 8.43 (64).
+    let mut t = T::new();
+    let sh = t.wb.sheet_mut(0).unwrap();
+    for (col, px) in [(2, 80.0), (3, 89.0), (4, 79.0), (5, 25.0)] {
+        sh.cols.insert(col, gridcraft_model::LineInfo { size: Some(px), ..Default::default() });
+    }
+    for (at, col) in [("H1", "B"), ("H2", "C"), ("H3", "D"), ("H4", "E"), ("H5", "F")] {
+        t.set(at, &format!("=CELL(\"width\",{col}1)"));
+    }
+    assert_eq!([t.num("H1"), t.num("H2"), t.num("H3"), t.num("H4"), t.num("H5")], [8.0, 11.0, 12.0, 11.0, 3.0]);
+}
+
+/// Expected results are Excel's, from Apache POI's `DGet.xls` (rows 46-49): a criteria cell holding
+/// a formula under a label that names no field is evaluated for every record.
+#[test]
+fn database_functions_with_computed_criteria() {
+    let mut t = T::new();
+    let db = [
+        ["name", "age", "size", "headgear", "glasses"],
+        ["Huey", "6", "45", "cap~", "FALSE"],
+        ["Dewey", "7", "fourty-six", "cap?", "FALSE"],
+        ["Louie", "8", "47", "cap*", "FALSE"],
+        ["Donald", "32", "70", "sailor's hat", "FALSE"],
+        ["Scrooge", "62", "65", "top hat", "TRUE"],
+    ];
+    for (r, row) in db.iter().enumerate() {
+        for (c, v) in row.iter().enumerate() {
+            t.set(&format!("{}{}", ["F", "G", "H", "I", "J"][c], r + 2), v);
+        }
+    }
+    t.set("G45", "7");
+    let cases = [
+        // Relative references are to the first record's row and move to each record's row;
+        // `$G$45` stays put.
+        ("G", "=G2<$G$45", "Dewey"),
+        // Column labels stand for the record's fields.
+        ("H", "=glasses=TRUE", "Scrooge"),
+        ("I", "=age<7", "Huey"),
+        ("J", "=size/7=10", "Donald"),
+        // An absolute reference to a cell that is not the first record's.
+        ("K", "=H3=$L$1", "Donald"),
+    ];
+    t.set("L1", "70");
+    for (i, (col, formula, _)) in cases.iter().enumerate() {
+        t.set(&format!("{col}46"), "Formula");
+        t.set(&format!("{col}47"), formula);
+        t.set(&format!("B{}", 46 + i), &format!("=DGET($F$2:$J$7,\"name\",{col}46:{col}47)"));
+    }
+    for (i, (_, formula, want)) in cases.iter().enumerate() {
+        assert_eq!(t.get(&format!("B{}", 46 + i)), Value::text(*want), "{formula}");
+    }
+    // Every database function takes them, ANDed with the other criteria of their row.
+    // Text sorts after numbers, so Dewey's "fourty-six" is > 40.
+    t.set("L47", "=size>40");
+    t.set("M46", "age");
+    t.set("M47", ">6");
+    t.set("B51", "=DCOUNT($F$2:$J$7,\"age\",I46:I47)");
+    t.set("B52", "=DSUM($F$2:$J$7,\"age\",G46:G47)");
+    t.set("B53", "=DCOUNTA($F$2:$J$7,\"name\",L46:M47)");
+    assert_eq!(t.num("B51"), 1.0);
+    assert_eq!(t.num("B52"), 7.0);
+    assert_eq!(t.num("B53"), 4.0);
+}
+
+#[test]
+fn offset_extreme_arguments_return_ref() {
+    let wb = Workbook::new();
+    for formula in [
+        "=OFFSET(B2,1E300,0)",
+        "=OFFSET(B2,0,1E300)",
+        "=OFFSET(B2,0,0,1E300,1)",
+        "=OFFSET(B2,0,0,1,1E300)",
+        "=OFFSET(B2,-1E300,0)",
+        "=OFFSET(B2,0,-1E300)",
+        "=OFFSET(B2,0,0,-1E300,1)",
+        "=OFFSET(B2,0,0,1,-1E300)",
+        "=OFFSET(B2,1E300,0,-1E300,1)",
+        "=OFFSET(B2,0,1E300,1,-1E300)",
+        "=OFFSET(B2,-1E300,0,-1E300,1)",
+    ] {
+        assert_eq!(crate::evaluate(&wb, 0, c("D1"), formula), Value::Error(CellError::Ref), "{formula}");
+    }
+    for (formula, expected) in [
+        ("=ROW(OFFSET(B2,1.9,0))", 3.0),
+        ("=COLUMN(OFFSET(B2,0,-1.9))", 1.0),
+        ("=ROWS(OFFSET(B2,0,0,-2,1))", 2.0),
+        ("=COLUMNS(OFFSET(B2,0,0,1,-2))", 2.0),
+        ("=ROWS(OFFSET(A1,0,0,1048576,1))", 1048576.0),
+    ] {
+        assert_eq!(crate::evaluate(&wb, 0, c("D1"), formula), Value::Number(expected), "{formula}");
+    }
+}

crates/calc/src/trimrange.rs

@@ -2,7 +2,7 @@
 //! documented semantics: trim_rows / trim_cols 0 none, 1 leading, 2 trailing, 3 both).
 
 use gridcraft_core::{Array, CellError, CellRef, RangeRef, Value};
-use gridcraft_formula::Expr;
+use gridcraft_formula::{Expr, TrimMode};
 
 use crate::eval::{Area, Ev, Evaluator, MAX_CELLS};
 
@@ -46,6 +46,20 @@ impl Evaluator<'_> {
         }
     }
 
+    /// A trim reference `A1.:E10` / `A1:.E10` / `A1.:.E10`: `TRIMRANGE(range, code, code)`.
+    pub(crate) fn trim_ref(&mut self, mode: TrimMode, x: &Expr) -> Ev {
+        let flags = match mode {
+            TrimMode::Leading => (true, false),
+            TrimMode::Trailing => (false, true),
+            TrimMode::All => (true, true),
+        };
+        let ev = self.eval(x);
+        match self.trim_ev(ev, flags, flags) {
+            Ok(ev) => ev,
+            Err(e) => Ev::V(Value::Error(e)),
+        }
+    }
+
     fn trim_mode(&mut self, args: &[Expr], i: usize) -> Result<(bool, bool), CellError> {
         match args.get(i) {
             None | Some(Expr::Missing) => Ok((true, true)),
@@ -63,8 +77,13 @@ impl Evaluator<'_> {
         };
         let rows = self.trim_mode(args, 1)?;
         let cols = self.trim_mode(args, 2)?;
+        let ev = self.eval(first);
+        self.trim_ev(ev, rows, cols)
+    }
+
+    fn trim_ev(&mut self, ev: Ev, rows: (bool, bool), cols: (bool, bool)) -> Result<Ev, CellError> {
         let none = rows == (false, false) && cols == (false, false);
-        match self.eval(first) {
+        match ev {
             Ev::R(areas) => {
                 let [a] = areas.as_slice() else { return Err(CellError::Value) };
                 if none {

crates/chart/src/axis.rs

@@ -122,7 +122,7 @@ impl Fmt {
     pub fn new(code: &str) -> Fmt {
         let t = code.trim();
         let general = t.is_empty() || t.eq_ignore_ascii_case("general");
-        Fmt { general, fmt: NumberFormat::parse(if general { "General" } else { t }) }
+        Fmt { general, fmt: NumberFormat::parse_cached(if general { "General" } else { t }) }
     }
     /// Formats `v`; `step` (axis labels) fixes the decimals for General.
     pub fn format(&self, v: f64, step: Option<f64>) -> String {

crates/chart/src/lib.rs

@@ -15,17 +15,18 @@ mod raster;
 mod render;
 mod resolve;
 mod sparkline;
+mod trend;
 
 #[cfg(test)]
 mod tests;
 
-pub use gridcraft_model::{Chart, ChartKind, LegendPos, SparklineKind};
+pub use gridcraft_model::{Chart, ChartKind, LegendPos, SparklineKind, Trendline, TrendlineKind};
 use serde::{Deserialize, Serialize};
 
 pub use axis::{Scale, format_number, nice_scale};
 pub use raster::rasterize;
-pub use render::{Swatch, legend_entries, render};
-pub use resolve::{default_palette, resolve, series_color};
+pub use render::{Swatch, legend_entries, render, supports_trendline};
+pub use resolve::{default_palette, resolve, series_color, series_plot_kind};
 pub use sparkline::render_sparkline;
 
 /// Straight (non-premultiplied) RGBA colour.
@@ -123,6 +124,9 @@ impl Measure for ApproxMeasure {
 pub struct ChartData {
     pub categories: Vec<String>,
     pub series: Vec<SeriesData>,
+    /// Workbook-theme colours for the points of pie-like charts, repeating (point `j` uses entry `j % len`); empty uses the default theme.
+    #[serde(default)]
+    pub palette: Vec<Rgba>,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -140,10 +144,19 @@ pub struct SeriesData {
     pub secondary: bool,
     /// Draw line segments as a smoothed (spline) curve.
     pub smooth: bool,
+    /// Trendlines to fit and draw over this series.
+    pub trendlines: Vec<TrendlineData>,
     /// Number format code of the source values ("General" by default).
     pub number_format: String,
 }
 
+/// A trendline to draw: the model settings with the line colour resolved against the theme.
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct TrendlineData {
+    pub spec: Trendline,
+    pub color: Rgba,
+}
+
 impl Default for SeriesData {
     fn default() -> Self {
         SeriesData {
@@ -155,6 +168,7 @@ impl Default for SeriesData {
             kind: ChartKind::ColumnClustered,
             secondary: false,
             smooth: false,
+            trendlines: vec![],
             number_format: "General".into(),
         }
     }

crates/chart/src/raster.rs

@@ -138,7 +138,8 @@ fn circle(cx: f32, cy: f32, r: f32) -> Vec<[f32; 2]> {
 }
 
 fn rounded_rect(x: f32, y: f32, w: f32, h: f32, r: f32) -> Vec<[f32; 2]> {
-    let r = r.clamp(0.0, w.min(h) / 2.0);
+    // A negative or NaN extent gives an upper bound of 0 (clamp panics if max < min or NaN).
+    let r = r.clamp(0.0, (w.min(h) / 2.0).max(0.0));
     if r < 0.5 {
         return vec![[x, y], [x + w, y], [x + w, y + h], [x, y + h]];
     }

crates/chart/src/render.rs

@@ -3,10 +3,11 @@
 use std::collections::HashSet;
 use std::f32::consts::{PI, TAU};
 
-use gridcraft_model::{Chart, ChartKind, LegendPos, Theme};
+use gridcraft_model::{Chart, ChartKind, LegendPos, LineDash, Theme, TrendlineKind};
 
 use crate::axis::{Fmt, Scale, clean, fixed_scale, nice_scale};
-use crate::resolve::{MAX_POINTS, MAX_SERIES, series_color};
+use crate::resolve::{MAX_POINTS, MAX_SERIES, MAX_TRENDLINES, series_color};
+use crate::trend::{auto_name, fit_trendline, moving_average};
 use crate::{ChartData, HAlign, Measure, Prim, Rgba, SeriesData, VAlign};
 
 pub(crate) const TEXT: Rgba = [0x59, 0x59, 0x59, 0xFF];
@@ -128,7 +129,7 @@ fn plot_kind(chart: &Chart, s: &SeriesData) -> ChartKind {
 fn point_color(data: &ChartData, j: usize) -> Rgba {
     match (j, data.series.first()) {
         (0, Some(s)) => s.color,
-        _ => series_color(&Theme::default(), j),
+        _ => j.checked_rem(data.palette.len()).and_then(|k| data.palette.get(k)).copied().unwrap_or_else(|| series_color(&Theme::default(), j)),
     }
 }
 
@@ -158,20 +159,28 @@ pub fn legend_entries(chart: &Chart, data: &ChartData) -> Vec<(String, Rgba, Swa
             let total = data.series.first().map(|s| s.color).unwrap_or(TEXT);
             vec![("Increase".into(), UP, Swatch::Box), ("Decrease".into(), DOWN, Swatch::Box), ("Total".into(), total, Swatch::Box)]
         }
-        _ => data
-            .series
-            .iter()
-            .take(MAX_SERIES)
-            .map(|s| {
-                let sw = match plot_kind(chart, s) {
-                    ChartKind::Line | ChartKind::LineStacked | ChartKind::Radar | ChartKind::ScatterLines => Swatch::Line,
-                    ChartKind::LineMarkers => Swatch::LineMarker,
-                    ChartKind::Scatter | ChartKind::Bubble => Swatch::Marker,
-                    _ => Swatch::Box,
-                };
-                (s.name.clone(), s.color, sw)
-            })
-            .collect(),
+        _ => {
+            let series = data.series.iter().take(MAX_SERIES);
+            let mut out: Vec<(String, Rgba, Swatch)> = series
+                .clone()
+                .map(|s| {
+                    let sw = match plot_kind(chart, s) {
+                        ChartKind::Line | ChartKind::LineStacked | ChartKind::Radar | ChartKind::ScatterLines => Swatch::Line,
+                        ChartKind::LineMarkers => Swatch::LineMarker,
+                        ChartKind::Scatter | ChartKind::Bubble => Swatch::Marker,
+                        _ => Swatch::Box,
+                    };
+                    (s.name.clone(), s.color, sw)
+                })
+                .collect();
+            // Trendlines follow the series, named "Linear (Sales)" unless given a name.
+            for s in series.filter(|s| supports_trendline(plot_kind(chart, s))) {
+                for t in s.trendlines.iter().take(MAX_TRENDLINES) {
+                    out.push((t.spec.name.clone().unwrap_or_else(|| auto_name(t.spec.kind, &s.name)), t.color, Swatch::Line));
+                }
+            }
+            out
+        }
     }
 }
 
@@ -181,6 +190,7 @@ fn sanitize_vals(v: &[Option<f64>]) -> Vec<Option<f64>> {
 
 fn sanitize(d: &ChartData) -> ChartData {
     ChartData {
+        palette: d.palette.iter().take(MAX_POINTS).copied().collect(),
         categories: d.categories.iter().take(MAX_POINTS).cloned().collect(),
         series: d
             .series
@@ -195,6 +205,7 @@ fn sanitize(d: &ChartData) -> ChartData {
                 kind: s.kind,
                 secondary: s.secondary,
                 smooth: s.smooth,
+                trendlines: s.trendlines.iter().take(MAX_TRENDLINES).cloned().collect(),
                 number_format: s.number_format.clone(),
             })
             .collect(),
@@ -244,7 +255,7 @@ fn draw_kind(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
         Doughnut => pie(ctx, chart, data, area, 0.5, false),
         Sunburst => pie(ctx, chart, data, area, 0.2, true),
         Treemap => treemap(ctx, chart, data, area),
-        Funnel => funnel(ctx, data, area),
+        Funnel => funnel(ctx, chart, data, area),
         Radar => radar(ctx, chart, data, area),
         _ => {
             let area = axis_titles(ctx, chart, area);
@@ -256,8 +267,8 @@ fn draw_kind(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
                 Scatter | ScatterLines | Bubble => scatter(ctx, chart, data, area),
                 Histogram => histogram(ctx, chart, data, area),
                 Waterfall => waterfall(ctx, chart, data, area),
-                BoxWhisker => box_whisker(ctx, data, area),
-                Stock => stock(ctx, data, area),
+                BoxWhisker => box_whisker(ctx, chart, data, area),
+                Stock => stock(ctx, chart, data, area),
                 _ => cartesian(ctx, chart, data, area, false),
             }
         }
@@ -630,6 +641,160 @@ fn value_range(it: impl Iterator<Item = f64>) -> Option<(f64, f64)> {
     })
 }
 
+// ---------------------------------------------------------------- trendlines
+
+/// Samples along a regression trendline.
+const TREND_STEPS: usize = 200;
+
+/// Whether series drawn as `k` show trendlines (Excel offers them on 2-D unstacked column,
+/// bar, line, area, scatter and bubble charts).
+pub fn supports_trendline(k: ChartKind) -> bool {
+    use ChartKind::*;
+    matches!(k, ColumnClustered | BarClustered | Line | LineMarkers | Area | Scatter | ScatterLines | Bubble)
+}
+
+/// A forecast distance as drawn: finite, non-negative and bounded.
+fn forecast(v: f64) -> f64 {
+    if v.is_finite() && v > 0.0 { v.min(1e9) } else { 0.0 }
+}
+
+/// Longest forward forecast among `s`'s regression trendlines.
+fn max_forward(s: &SeriesData) -> f64 {
+    s.trendlines.iter().filter(|t| !matches!(t.spec.kind, TrendlineKind::MovingAverage(_))).map(|t| forecast(t.spec.forward)).fold(0.0, f64::max)
+}
+
+/// Longest backward forecast among `s`'s regression trendlines.
+fn max_backward(s: &SeriesData) -> f64 {
+    s.trendlines.iter().filter(|t| !matches!(t.spec.kind, TrendlineKind::MovingAverage(_))).map(|t| forecast(t.spec.backward)).fold(0.0, f64::max)
+}
+
+/// Liang–Barsky: the part of segment `a`–`b` inside the unit square, with whether the start and
+/// end were cut.
+#[allow(clippy::type_complexity)]
+fn clip_segment(a: (f64, f64), b: (f64, f64)) -> Option<((f64, f64), (f64, f64), bool, bool)> {
+    let (dx, dy) = (b.0 - a.0, b.1 - a.1);
+    let (mut t0, mut t1) = (0.0f64, 1.0f64);
+    for (p, q) in [(-dx, a.0), (dx, 1.0 - a.0), (-dy, a.1), (dy, 1.0 - a.1)] {
+        if p == 0.0 {
+            if q < 0.0 {
+                return None;
+            }
+        } else {
+            let r = q / p;
+            if p < 0.0 {
+                if r > t1 {
+                    return None;
+                }
+                t0 = t0.max(r);
+            } else {
+                if r < t0 {
+                    return None;
+                }
+                t1 = t1.min(r);
+            }
+        }
+    }
+    Some(((a.0 + t0 * dx, a.1 + t0 * dy), (a.0 + t1 * dx, a.1 + t1 * dy), t0 > 0.0, t1 < 1.0))
+}
+
+/// Clips a sampled polyline in plot fractions (`None` = gap) to the plot box (the unit
+/// square), returning the visible runs.
+fn clip_unit(pts: &[Option<(f64, f64)>]) -> Vec<Vec<(f64, f64)>> {
+    const LIM: f64 = 1e9;
+    let ok = |p: &(f64, f64)| p.0.is_finite() && p.1.is_finite();
+    let cl = |p: (f64, f64)| (p.0.clamp(-LIM, LIM), p.1.clamp(-LIM, LIM));
+    let mut runs: Vec<Vec<(f64, f64)>> = Vec::new();
+    let mut run: Vec<(f64, f64)> = Vec::new();
+    for w in pts.windows(2) {
+        let seg = match w {
+            [Some(a), Some(b)] if ok(a) && ok(b) => clip_segment(cl(*a), cl(*b)),
+            _ => None,
+        };
+        match seg {
+            Some((p, q, cut_start, cut_end)) => {
+                if cut_start || run.is_empty() {
+                    if run.len() >= 2 {
+                        runs.push(std::mem::take(&mut run));
+                    }
+                    run.clear();
+                    run.push(p);
+                }
+                run.push(q);
+                if cut_end {
+                    runs.push(std::mem::take(&mut run));
+                }
+            }
+            None => {
+                if run.len() >= 2 {
+                    runs.push(std::mem::take(&mut run));
+                }
+                run.clear();
+            }
+        }
+    }
+    if run.len() >= 2 {
+        runs.push(run);
+    }
+    runs
+}
+
+/// Draws `s`'s trendlines fitted to its plotted points `pts` (data x, y). `frac` maps data to
+/// fractions of the plot box (0..1 inside, along the x and y axes), `px` fractions to pixels.
+/// Equation and R² label lines are appended to `labels`. Degenerate fits draw nothing.
+fn draw_trendlines(
+    ctx: &mut Ctx,
+    s: &SeriesData,
+    pts: &[(f64, f64)],
+    frac: &dyn Fn(f64, f64) -> (f64, f64),
+    px: &dyn Fn((f64, f64)) -> [f32; 2],
+    labels: &mut Vec<String>,
+) {
+    let Some((xlo, xhi)) = value_range(pts.iter().map(|p| p.0)) else { return };
+    for t in s.trendlines.iter().take(MAX_TRENDLINES) {
+        let spec = &t.spec;
+        let samples: Vec<Option<(f64, f64)>> = match spec.kind {
+            TrendlineKind::MovingAverage(p) => moving_average(pts, p).into_iter().map(|(x, y)| Some(frac(x, y))).collect(),
+            _ => {
+                let Some(fit) = fit_trendline(spec, pts) else { continue };
+                let (lo, hi) = (xlo - forecast(spec.backward), xhi + forecast(spec.forward));
+                if spec.display_equation {
+                    labels.push(fit.equation());
+                }
+                if spec.display_r_squared {
+                    labels.push(fit.r_squared());
+                }
+                (0..=TREND_STEPS)
+                    .map(|i| {
+                        let x = lo + (hi - lo) * i as f64 / TREND_STEPS as f64;
+                        fit.eval(x).map(|y| frac(x, y))
+                    })
+                    .collect()
+            }
+        };
+        let width = spec.width.filter(|w| w.is_finite()).unwrap_or(1.5).clamp(0.25, 12.0);
+        let dash = spec.dash != Some(LineDash::Solid);
+        for run in clip_unit(&samples) {
+            let line = decimate(run.into_iter().map(px).collect(), MAX_LINE_PTS);
+            if line.len() >= 2 {
+                ctx.out.push(Prim::Line { pts: line, color: t.color, width, dash });
+            }
+        }
+    }
+}
+
+/// Trendline equation / R² labels, stacked in the plot's top-right corner.
+fn draw_trend_labels(ctx: &mut Ctx, plot: Bx, labels: &[String]) {
+    let lh = LABEL_SIZE * 1.3;
+    for (i, t) in labels.iter().enumerate() {
+        let y = plot.y + 4.0 + i as f32 * lh;
+        if y + lh > plot.bottom() {
+            break;
+        }
+        let t = ctx.fit(t, LABEL_SIZE, plot.w - 8.0);
+        ctx.text(plot.right() - 4.0, y, &t, LABEL_SIZE, TEXT, HAlign::Right, VAlign::Top);
+    }
+}
+
 // ---------------------------------------------------------------- cartesian (column/bar/line/area/combo)
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -763,14 +928,23 @@ fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, horizonta
     let Some((s1, f1)) = axes.first() else { return };
     let y1 = ValAxis { scale: *s1, fmt: f1 };
     let y2 = axes.get(1).map(|(s, f)| ValAxis { scale: *s, fmt: f });
-    let labels: Vec<String> = (0..ncat).map(|j| cat_label(data, j)).collect();
+    // A forward forecast on a category axis adds empty category slots after the data.
+    let fwd = data
+        .series
+        .iter()
+        .enumerate()
+        .filter(|(i, _)| kinds.get(*i).is_some_and(|k| supports_trendline(*k)))
+        .map(|(_, s)| max_forward(s))
+        .fold(0.0, f64::max);
+    let ncat_slots = ncat.saturating_add(fwd.ceil() as usize).min(MAX_CATS.max(ncat));
+    let labels: Vec<String> = (0..ncat_slots).map(|j| if j < ncat { cat_label(data, j) } else { String::new() }).collect();
     let plot = frame(ctx, area, CatAxis::Labels(&labels), &y1, y2.as_ref(), horizontal, chart.gridlines);
     if !plot.ok() {
         return;
     }
     let scale_of = |i: usize| -> Scale { if sec.get(i).copied().unwrap_or(false) { y2.as_ref().map(|a| a.scale).unwrap_or(*s1) } else { *s1 } };
     let cat_len = if horizontal { plot.h } else { plot.w };
-    let cw = cat_len / ncat as f32;
+    let cw = cat_len / ncat_slots as f32;
     let center = |j: usize| if horizontal { plot.bottom() - (j as f32 + 0.5) * cw } else { plot.x + (j as f32 + 0.5) * cw };
     let vpos = |v: f64, sc: &Scale| if horizontal { plot.x + sc.frac(v) * plot.w } else { plot.bottom() - sc.frac(v) * plot.h };
 
@@ -797,6 +971,8 @@ fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, horizonta
     let nslots = slot_keys.len().max(1) as f32;
     let bw = cw / (nslots + 1.5);
     let labels_on = chart.data_labels && ncat <= MAX_LABELS;
+    // Area labels wait until every area is filled, so a later (stacked) area can't paint over them.
+    let mut area_labels = Vec::new();
 
     // Areas first, then columns, then lines on top.
     for pass in 0..3 {
@@ -825,6 +1001,13 @@ fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, horizonta
                         let c = center(j);
                         top.push([c, vpos(t, &sc)]);
                         base.push([c, vpos(b, &sc)]);
+                        // Source values (not stack totals), just above the top edge like the line labels.
+                        if labels_on
+                            && sp.is_some()
+                            && let Some(v) = s.values.get(j).copied().flatten()
+                        {
+                            area_labels.push((c, vpos(t, &sc) - 5.0, fmt.format(v, None)));
+                        }
                     }
                     if top.len() == 1 {
                         // A single point: give it some width.
@@ -899,7 +1082,29 @@ fn cartesian(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx, horizonta
                 }
             }
         }
+        for (x, y, t) in area_labels.drain(..) {
+            ctx.text(x, y, &t, LABEL_SIZE, TEXT, HAlign::Center, VAlign::Bottom);
+        }
     }
+    // Trendlines on top: x is the category number 1..n.
+    let mut trend_labels = Vec::new();
+    for (i, s) in data.series.iter().enumerate() {
+        if s.trendlines.is_empty() || !kinds.get(i).is_some_and(|k| supports_trendline(*k)) {
+            continue;
+        }
+        let sc = scale_of(i);
+        let pts: Vec<(f64, f64)> = s.values.iter().take(ncat).enumerate().filter_map(|(j, v)| v.map(|v| ((j + 1) as f64, v))).collect();
+        let frac = |x: f64, y: f64| ((x - 0.5) / ncat_slots as f64, (y - sc.min) / (sc.max - sc.min));
+        let px = |(fx, fy): (f64, f64)| {
+            if horizontal {
+                [plot.x + fy as f32 * plot.w, plot.bottom() - fx as f32 * plot.h]
+            } else {
+                [plot.x + fx as f32 * plot.w, plot.bottom() - fy as f32 * plot.h]
+            }
+        };
+        draw_trendlines(ctx, s, &pts, &frac, &px, &mut trend_labels);
+    }
+    draw_trend_labels(ctx, plot, &trend_labels);
 }
 
 // ---------------------------------------------------------------- scatter & bubble
@@ -922,7 +1127,14 @@ fn scatter(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
             .collect()
     };
     let all: Vec<Vec<Option<(f64, f64)>>> = data.series.iter().map(pts_of).collect();
-    let Some((xlo, xhi)) = value_range(all.iter().flatten().flatten().map(|p| p.0)) else { return };
+    let Some((mut xlo, mut xhi)) = value_range(all.iter().flatten().flatten().map(|p| p.0)) else { return };
+    // Forecasts extend the x axis to the trendline's ends.
+    for (s, pts) in data.series.iter().zip(&all) {
+        if let Some((lo, hi)) = value_range(pts.iter().flatten().map(|p| p.0)).filter(|_| !s.trendlines.is_empty()) {
+            xlo = xlo.min(lo - max_backward(s));
+            xhi = xhi.max(hi + max_forward(s));
+        }
+    }
     let Some((ylo, yhi)) = value_range(all.iter().flatten().flatten().map(|p| p.1)) else { return };
     let xs = nice_scale(xlo, xhi, false);
     let ys = nice_scale(ylo, yhi, false);
@@ -976,6 +1188,17 @@ fn scatter(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
             }
         }
     }
+    let mut trend_labels = Vec::new();
+    for (s, pts) in data.series.iter().zip(&all) {
+        if s.trendlines.is_empty() {
+            continue;
+        }
+        let pts: Vec<(f64, f64)> = pts.iter().flatten().copied().collect();
+        let frac = |x: f64, y: f64| ((x - xs.min) / (xs.max - xs.min), (y - ys.min) / (ys.max - ys.min));
+        let px = |(fx, fy): (f64, f64)| [plot.x + fx as f32 * plot.w, plot.bottom() - fy as f32 * plot.h];
+        draw_trendlines(ctx, s, &pts, &frac, &px, &mut trend_labels);
+    }
+    draw_trend_labels(ctx, plot, &trend_labels);
 }
 
 // ---------------------------------------------------------------- histogram
@@ -991,10 +1214,12 @@ fn histogram(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
         bins = 1;
     }
     let width = if bins == 1 && span.partial_cmp(&0.0) != Some(std::cmp::Ordering::Greater) { 1.0 } else { span / bins as f64 };
+    // Upper edge of each bin, exactly as shown in the labels below. Bins are right-inclusive (the first is closed on both sides), so a value
+    // equal to an edge belongs to the bin that ends there.
+    let edges: Vec<f64> = (0..bins).map(|b| if b + 1 == bins { hi.max(lo + b as f64 * width) } else { lo + (b + 1) as f64 * width }).collect();
     let mut counts = vec![0usize; bins];
     for v in &vals {
-        let b = if width > 0.0 { ((v - lo) / width).floor() } else { 0.0 };
-        let b = if b.is_finite() && b > 0.0 { (b as usize).min(bins - 1) } else { 0 };
+        let b = edges.partition_point(|e| e < v).min(bins - 1);
         if let Some(c) = counts.get_mut(b) {
             *c += 1;
         }
@@ -1003,7 +1228,7 @@ fn histogram(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
     let labels: Vec<String> = (0..bins)
         .map(|b| {
             let a = lo + b as f64 * width;
-            let e = if b + 1 == bins { hi.max(a) } else { a + width };
+            let e = edges.get(b).copied().unwrap_or(a);
             let open = if b == 0 { '[' } else { '(' };
             format!("{open}{}, {}]", f.format(a, Some(width / 10.0)), f.format(e, Some(width / 10.0)))
         })
@@ -1091,7 +1316,7 @@ fn waterfall(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
 
 // ---------------------------------------------------------------- funnel
 
-fn funnel(ctx: &mut Ctx, data: &ChartData, area: Bx) {
+fn funnel(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
     let Some(s) = data.series.first() else { return };
     let n = data.categories.len().max(s.values.len()).min(MAX_CATS);
     if n == 0 {
@@ -1121,9 +1346,11 @@ fn funnel(ctx: &mut Ctx, data: &ChartData, area: Bx) {
         }
         if show {
             let yc = y + bh / 2.0;
-            let t = f.format(s.values.get(j).copied().flatten().unwrap_or(0.0), None);
-            let color = if ctx.tw(&t, LABEL_SIZE) + 4.0 <= bw { on(s.color) } else { TEXT };
-            ctx.text(plot.cx(), yc, &t, LABEL_SIZE, color, HAlign::Center, VAlign::Middle);
+            if chart.data_labels {
+                let t = f.format(s.values.get(j).copied().flatten().unwrap_or(0.0), None);
+                let color = if ctx.tw(&t, LABEL_SIZE) + 4.0 <= bw { on(s.color) } else { TEXT };
+                ctx.text(plot.cx(), yc, &t, LABEL_SIZE, color, HAlign::Center, VAlign::Middle);
+            }
             let l = ctx.fit(labels.get(j).map(String::as_str).unwrap_or(""), LABEL_SIZE, lw - 8.0);
             ctx.text(plot.x - 6.0, yc, &l, LABEL_SIZE, TEXT, HAlign::Right, VAlign::Middle);
         }
@@ -1347,12 +1574,12 @@ fn quantile(sorted: &[f64], q: f64) -> f64 {
     a + (b - a) * frac
 }
 
-fn box_whisker(ctx: &mut Ctx, data: &ChartData, area: Bx) {
+fn box_whisker(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
     let labels: Vec<String> = data.series.iter().map(|s| s.name.clone()).collect();
     let Some((lo, hi)) = value_range(data.series.iter().flat_map(|s| s.values.iter().flatten().copied())) else { return };
     let ys = nice_scale(lo, hi, false);
     let f = Fmt::new(data.series.first().map(|s| s.number_format.as_str()).unwrap_or("General"));
-    let plot = frame(ctx, area, CatAxis::Labels(&labels), &ValAxis { scale: ys, fmt: &f }, None, false, true);
+    let plot = frame(ctx, area, CatAxis::Labels(&labels), &ValAxis { scale: ys, fmt: &f }, None, false, chart.gridlines);
     if !plot.ok() {
         return;
     }
@@ -1391,7 +1618,7 @@ fn box_whisker(ctx: &mut Ctx, data: &ChartData, area: Bx) {
 
 // ---------------------------------------------------------------- stock
 
-fn stock(ctx: &mut Ctx, data: &ChartData, area: Bx) {
+fn stock(ctx: &mut Ctx, chart: &Chart, data: &ChartData, area: Bx) {
     let ncat = data.categories.len().max(data.series.iter().map(|s| s.values.len()).max().unwrap_or(0)).min(MAX_CATS);
     if ncat == 0 {
         return;
@@ -1400,7 +1627,7 @@ fn stock(ctx: &mut Ctx, data: &ChartData, area: Bx) {
     let Some((lo, hi)) = value_range(data.series.iter().flat_map(|s| s.values.iter().flatten().copied())) else { return };
     let ys = nice_scale(lo, hi, false);
     let f = Fmt::new(data.series.first().map(|s| s.number_format.as_str()).unwrap_or("General"));
-    let plot = frame(ctx, area, CatAxis::Labels(&labels), &ValAxis { scale: ys, fmt: &f }, None, false, true);
+    let plot = frame(ctx, area, CatAxis::Labels(&labels), &ValAxis { scale: ys, fmt: &f }, None, false, chart.gridlines);
     if !plot.ok() {
         return;
     }

crates/chart/src/resolve.rs

@@ -5,15 +5,19 @@ use gridcraft_core::{CellRef, RangeRef, Value, number_to_text};
 use gridcraft_model::{Chart, ChartKind, Theme, Workbook, style::apply_tint};
 use gridcraft_numfmt::{NumberFormat, format_value};
 
-use crate::{ChartData, Rgba, SeriesData};
+use crate::{ChartData, Rgba, SeriesData, TrendlineData};
 
 /// Cap on points per series (keeps whole-column references from exploding).
 pub(crate) const MAX_POINTS: usize = 100_000;
 /// Cap on series per chart.
 pub(crate) const MAX_SERIES: usize = 255;
+/// Cap on trendlines drawn per series.
+pub(crate) const MAX_TRENDLINES: usize = 16;
 
 /// Tints used for series beyond the six theme accents: lighter, darker, lighter still…
 const CYCLE_TINTS: [f64; 6] = [0.0, 0.4, -0.25, 0.6, -0.5, 0.2];
+/// `series_color` repeats after this many colours (six accents × the tints).
+pub(crate) const PALETTE_CYCLE: usize = 6 * CYCLE_TINTS.len();
 
 /// Colour of the `i`-th series: theme accents 1–6, then tinted variations of them.
 pub fn series_color(theme: &Theme, i: usize) -> Rgba {
@@ -143,7 +147,7 @@ fn category_texts(wb: &Workbook, sheet: usize, formula: &str) -> Vec<String> {
                 if let Some(c) = at {
                     let code = &wb.styles.get(s.style_id(c)).num_fmt.0;
                     if !code.eq_ignore_ascii_case("general") {
-                        return format_value(v, &NumberFormat::parse(code), wb.date_system).text;
+                        return format_value(v, &NumberFormat::parse_cached(code), wb.date_system).text;
                     }
                 }
             }
@@ -181,6 +185,11 @@ fn effective_kind(chart_kind: ChartKind, series_kind: Option<ChartKind>, i: usiz
     }
 }
 
+/// The kind series `i` of `chart` is drawn as: its own kind in a combo chart, else the chart's.
+pub fn series_plot_kind(chart: &Chart, i: usize) -> ChartKind {
+    if chart.kind == ChartKind::Combo { effective_kind(chart.kind, chart.series.get(i).and_then(|s| s.kind), i) } else { chart.kind }
+}
+
 /// Evaluates a chart's series formulas: names, values, categories (default "1", "2", …), X
 /// values (scatter/bubble), bubble sizes, number formats and colours (explicit, else the
 /// default palette derived from the workbook theme accents).
@@ -208,6 +217,15 @@ pub fn resolve(wb: &Workbook, sheet: usize, chart: &Chart) -> ChartData {
             }
         }
         let sizes = s.bubble_sizes.as_deref().map(|f| nums(wb, sheet, f));
+        let trendlines = s
+            .trendlines
+            .iter()
+            .take(MAX_TRENDLINES)
+            .map(|t| TrendlineData {
+                spec: t.clone(),
+                color: t.color.as_ref().and_then(|c| c.resolve(&wb.theme)).map(|[r, g, b]| [r, g, b, 0xFF]).unwrap_or(color),
+            })
+            .collect();
         series.push(SeriesData {
             name,
             values,
@@ -217,10 +235,12 @@ pub fn resolve(wb: &Workbook, sheet: usize, chart: &Chart) -> ChartData {
             kind,
             secondary: s.secondary,
             smooth: s.smooth,
+            trendlines,
             number_format: ref_format(wb, sheet, &s.values),
         });
     }
     let n = series.iter().map(|s| s.values.len()).max().unwrap_or(0);
     let categories = categories.unwrap_or_else(|| (1..=n).map(|i| i.to_string()).collect());
-    ChartData { categories, series }
+    let palette = default_palette(&wb.theme, n.min(PALETTE_CYCLE));
+    ChartData { categories, series, palette }
 }

crates/chart/src/tests.rs

@@ -62,6 +62,7 @@ fn series(name: &str, values: &[f64], color: Rgba, kind: ChartKind) -> SeriesDat
         kind,
         secondary: false,
         smooth: false,
+        trendlines: Vec::new(),
         number_format: "$#,##0".into(),
     }
 }
@@ -73,6 +74,7 @@ fn sample(kind: ChartKind) -> ChartData {
     let mut b = series("East", &[38000.0, 30000.0, 45000.0, 61870.0, 52000.0, 41000.0], [200, 80, 40, 255], k2);
     b.secondary = kind == ChartKind::Combo;
     ChartData {
+        palette: vec![],
         categories: cats.iter().map(|s| s.to_string()).collect(),
         series: vec![
             series("North", &[12000.0, -4000.0, 23000.0, 31000.0, 18000.0, 27000.0], [20, 96, 130, 255], k1),
@@ -226,6 +228,7 @@ fn resolve_from_workbook() {
             secondary: false,
             kind: None,
             smooth: false,
+            trendlines: Vec::new(),
         },
         Series {
             name: None,
@@ -236,6 +239,7 @@ fn resolve_from_workbook() {
             secondary: true,
             kind: None,
             smooth: false,
+            trendlines: Vec::new(),
         },
         Series {
             name: Some("Literal".into()),
@@ -246,6 +250,7 @@ fn resolve_from_workbook() {
             secondary: false,
             kind: None,
             smooth: false,
+            trendlines: Vec::new(),
         },
     ];
     let d = resolve(&wb, 0, &c);
@@ -283,6 +288,7 @@ fn resolve_from_workbook() {
             secondary: false,
             kind: None,
             smooth: false,
+            trendlines: Vec::new(),
         },
         Series {
             name: None,
@@ -293,6 +299,7 @@ fn resolve_from_workbook() {
             secondary: true,
             kind: None,
             smooth: false,
+            trendlines: Vec::new(),
         },
     ];
     let d = resolve(&wb, 0, &c);
@@ -308,6 +315,7 @@ fn resolve_from_workbook() {
         secondary: false,
         kind: None,
         smooth: false,
+        trendlines: Vec::new(),
     }];
     let d = resolve(&wb, 0, &c);
     assert_eq!(d.series[0].x.as_ref().map(|x| x.len()), Some(3));
@@ -324,6 +332,7 @@ fn resolve_from_workbook() {
         secondary: false,
         kind: None,
         smooth: false,
+        trendlines: Vec::new(),
     }];
     let d = resolve(&wb, 7, &c);
     assert_eq!(d.series.len(), 1);
@@ -354,7 +363,7 @@ fn scatter_with_text_x_values_numbers_the_points() {
         let d = resolve(&wb, 0, &c);
         assert_eq!(d.series[0].x, None, "{kind:?}");
         let prims = render(&c, &d, 400.0, 300.0, &ApproxMeasure);
-        let empty = render(&c, &ChartData { categories: vec![], series: vec![] }, 400.0, 300.0, &ApproxMeasure);
+        let empty = render(&c, &ChartData { palette: vec![], categories: vec![], series: vec![] }, 400.0, 300.0, &ApproxMeasure);
         assert!(prims.len() > empty.len() + 2, "{kind:?} draws its points");
         // Numeric X values are kept.
         c.series[0].categories = Some("Sheet1!$C$1:$C$3".into());
@@ -412,6 +421,16 @@ fn rasterize_bar_center_has_bar_color() {
     assert!(rasterize(&[], 100_000, 100_000, [0; 4]).is_empty());
 }
 
+#[test]
+fn rasterize_does_not_panic_on_negative_rect_extents() {
+    let red = [255, 0, 0, 255];
+    for (w, h) in [(-10.0, 10.0), (10.0, -10.0), (-10.0, -10.0), (f32::NAN, f32::NAN)] {
+        let rect = Prim::Rect { x: 5.0, y: 5.0, w, h, fill: Some(red), stroke: Some((red, 2.0)), radius: 0.0 };
+        let img = rasterize(&[rect], 20, 20, [0, 0, 0, 0]);
+        assert_eq!(img.len(), 20 * 20 * 4);
+    }
+}
+
 #[test]
 fn pie_starts_at_twelve_clockwise() {
     let c = chart(ChartKind::Pie);
@@ -437,7 +456,8 @@ fn pie_starts_at_twelve_clockwise() {
 #[test]
 fn negative_values_put_axis_below_zero() {
     let c = chart(ChartKind::ColumnClustered);
-    let d = ChartData { categories: vec![], series: vec![series("N", &[-5.0, 3.0, -2.0], [1, 2, 3, 255], ChartKind::ColumnClustered)] };
+    let d =
+        ChartData { palette: vec![], categories: vec![], series: vec![series("N", &[-5.0, 3.0, -2.0], [1, 2, 3, 255], ChartKind::ColumnClustered)] };
     let prims = render(&c, &d, 400.0, 300.0, &ApproxMeasure);
     let t = texts(&prims);
     assert!(t.iter().any(|s| s.starts_with('-') || s.starts_with("($") || s.starts_with("-$")), "{t:?}");
@@ -448,8 +468,13 @@ fn negative_values_put_axis_below_zero() {
 fn edge_cases_never_panic() {
     let m = ApproxMeasure;
     let empty = ChartData::default();
-    let zeros = ChartData { categories: vec!["a".into(), "b".into()], series: vec![series("z", &[0.0, 0.0], [0, 0, 0, 255], ChartKind::Line)] };
+    let zeros = ChartData {
+        palette: vec![],
+        categories: vec!["a".into(), "b".into()],
+        series: vec![series("z", &[0.0, 0.0], [0, 0, 0, 255], ChartKind::Line)],
+    };
     let weird = ChartData {
+        palette: vec![],
         categories: vec![String::new(); 3],
         series: vec![SeriesData {
             name: "w".repeat(500),
@@ -480,7 +505,7 @@ fn thousands_of_points_are_decimated() {
     let vals: Vec<f64> = (0..n).map(|i| ((i as f64) * 0.01).sin() * 100.0 + i as f64 * 0.001).collect();
     let mut c = chart(ChartKind::Line);
     c.data_labels = true;
-    let d = ChartData { categories: vec![], series: vec![series("big", &vals, [9, 9, 9, 255], ChartKind::Line)] };
+    let d = ChartData { palette: vec![], categories: vec![], series: vec![series("big", &vals, [9, 9, 9, 255], ChartKind::Line)] };
     let prims = render(&c, &d, 800.0, 400.0, &ApproxMeasure);
     let max_line = prims
         .iter()
@@ -505,7 +530,7 @@ fn smooth_line_adds_interpolated_points_and_keeps_endpoints() {
     let line_pts = |smooth: bool, m: &ApproxMeasure| -> usize {
         let mut s = series("L", &[1.0, 5.0, 2.0, 6.0], [10, 20, 30, 255], ChartKind::Line);
         s.smooth = smooth;
-        let d = ChartData { categories: cats.clone(), series: vec![s] };
+        let d = ChartData { palette: vec![], categories: cats.clone(), series: vec![s] };
         render(&chart(ChartKind::Line), &d, 600.0, 400.0, m)
             .iter()
             .filter_map(|p| match p {
@@ -522,7 +547,7 @@ fn smooth_line_adds_interpolated_points_and_keeps_endpoints() {
     // Rendering either way must stay finite and inside the canvas.
     let mut s = series("L", &[1.0, 5.0, 2.0, 6.0], [10, 20, 30, 255], ChartKind::Line);
     s.smooth = true;
-    let d = ChartData { categories: cats, series: vec![s] };
+    let d = ChartData { palette: vec![], categories: cats, series: vec![s] };
     assert_sane(&render(&chart(ChartKind::Line), &d, 600.0, 400.0, &m), 600.0, 400.0);
 }
 
@@ -532,7 +557,7 @@ fn smooth_line_splits_at_gaps() {
     let mut s = series("L", &[1.0, 5.0, 2.0, 6.0], [10, 20, 30, 255], ChartKind::Line);
     s.smooth = true;
     s.values[1] = None; // gap between two data points
-    let d = ChartData { categories: vec!["a".into(), "b".into(), "c".into(), "d".into()], series: vec![s] };
+    let d = ChartData { palette: vec![], categories: vec!["a".into(), "b".into(), "c".into(), "d".into()], series: vec![s] };
     let prims = render(&chart(ChartKind::Line), &d, 600.0, 400.0, &m);
     // Two separate runs (before/after the gap) → at least two line primitives.
     let lines = prims.iter().filter(|p| matches!(p, Prim::Line { .. })).count();
@@ -583,11 +608,33 @@ fn fuzz_random_data_and_sizes() {
                 kind: ALL_KINDS[(r.next() % ALL_KINDS.len() as u64) as usize],
                 secondary: r.next().is_multiple_of(3),
                 smooth: r.next().is_multiple_of(4),
+                trendlines: (0..r.next() % 3)
+                    .map(|_| TrendlineData {
+                        spec: Trendline {
+                            kind: [
+                                TrendlineKind::Linear,
+                                TrendlineKind::Exponential,
+                                TrendlineKind::Logarithmic,
+                                TrendlineKind::Polynomial((r.next() % 8) as u8),
+                                TrendlineKind::Power,
+                                TrendlineKind::MovingAverage((r.next() % 6) as u32),
+                            ][(r.next() % 6) as usize],
+                            forward: [0.0, 1.5, -2.0, f64::NAN, 1e300][(r.next() % 5) as usize],
+                            backward: [0.0, 0.5, f64::INFINITY][(r.next() % 3) as usize],
+                            intercept: [None, Some(0.0), Some(-5.0), Some(f64::NAN)][(r.next() % 4) as usize],
+                            display_equation: r.next().is_multiple_of(2),
+                            display_r_squared: r.next().is_multiple_of(2),
+                            width: [None, Some(0.0), Some(f32::NAN), Some(3.0)][(r.next() % 4) as usize],
+                            ..Trendline::default()
+                        },
+                        color: [0, 0, 0, 255],
+                    })
+                    .collect(),
                 number_format: ["General", "$#,##0", "0.00%", "yyyy-mm-dd", "#,##0.0;[Red]-#,##0.0", "@"][(r.next() % 6) as usize].into(),
             })
             .collect();
         let ncat = (r.next() % 50) as usize;
-        let d = ChartData { categories: (0..ncat).map(|i| "c".repeat(i % 7) + &i.to_string()).collect(), series };
+        let d = ChartData { palette: vec![], categories: (0..ncat).map(|i| "c".repeat(i % 7) + &i.to_string()).collect(), series };
         let mut c = chart(kind);
         c.legend = [LegendPos::None, LegendPos::Bottom, LegendPos::Top, LegendPos::Left, LegendPos::Right][(r.next() % 5) as usize];
         c.data_labels = r.next().is_multiple_of(2);
@@ -631,9 +678,197 @@ fn sparklines() {
     assert!(render_sparkline(SparklineKind::Line, &[], [0; 4], false, 10.0, 10.0).is_empty());
 }
 
+// ---------------------------------------------------------------- trendlines
+
+fn close(a: f64, b: f64) -> bool {
+    (a - b).abs() <= 1e-9 * (1.0 + b.abs())
+}
+
+fn fit(kind: TrendlineKind, pts: &[(f64, f64)]) -> crate::trend::TrendFit {
+    crate::trend::fit_trendline(&Trendline { kind, ..Trendline::default() }, pts).expect("fits")
+}
+
+#[test]
+fn linear_trendline_matches_least_squares() {
+    // Slope 0.6, intercept 2.2, R² = 1 - 2.4 / 6.
+    let f = fit(TrendlineKind::Linear, &[(1.0, 2.0), (2.0, 4.0), (3.0, 5.0), (4.0, 4.0), (5.0, 5.0)]);
+    assert!(close(f.coef[0], 2.2) && close(f.coef[1], 0.6), "{:?}", f.coef);
+    assert!(close(f.r2.unwrap(), 0.6));
+    assert_eq!(f.equation(), "y = 0.6x + 2.2");
+    assert_eq!(f.r_squared(), "R² = 0.6");
+    assert!(close(f.eval(10.0).unwrap(), 8.2));
+    let down = fit(TrendlineKind::Linear, &[(0.0, 1.0), (1.0, -1.0), (2.0, -3.0)]);
+    assert_eq!(down.equation(), "y = -2x + 1");
+}
+
+#[test]
+fn set_intercept_fits_through_it() {
+    // Through the origin: slope Σxy / Σx² = 30 / 14; R² against the uncentred total.
+    let pts = [(1.0, 2.0), (2.0, 5.0), (3.0, 6.0)];
+    let f = crate::trend::fit_trendline(&Trendline { intercept: Some(0.0), ..Trendline::default() }, &pts).unwrap();
+    assert!(close(f.coef[0], 0.0) && close(f.coef[1], 15.0 / 7.0), "{:?}", f.coef);
+    let ss_res: f64 = pts.iter().map(|(x, y)| (y - 15.0 / 7.0 * x).powi(2)).sum();
+    assert!(close(f.r2.unwrap(), 1.0 - ss_res / 65.0));
+    let q = crate::trend::fit_trendline(
+        &Trendline { kind: TrendlineKind::Polynomial(2), intercept: Some(2.0), ..Trendline::default() },
+        &[(1.0, 0.0), (2.0, 0.0), (3.0, 2.0), (4.0, 6.0)],
+    )
+    .unwrap();
+    assert!(close(q.coef[0], 2.0) && close(q.coef[1], -3.0) && close(q.coef[2], 1.0), "{:?}", q.coef);
+}
+
+#[test]
+fn transformed_trendlines_recover_their_curves() {
+    let xs: [f64; 6] = [0.5, 1.0, 2.0, 3.0, 4.5, 6.0];
+    let e = fit(TrendlineKind::Exponential, &xs.map(|x| (x, 3.0 * (0.5 * x).exp())));
+    assert!(close(e.coef[0].exp(), 3.0) && close(e.coef[1], 0.5));
+    assert_eq!(e.equation(), "y = 3e^(0.5x)");
+    let l = fit(TrendlineKind::Logarithmic, &xs.map(|x| (x, 2.0 * x.ln() + 1.0)));
+    assert!(close(l.coef[1], 2.0) && close(l.coef[0], 1.0));
+    assert_eq!(l.equation(), "y = 2ln(x) + 1");
+    let p = fit(TrendlineKind::Power, &xs.map(|x| (x, 4.0 * x.powf(1.5))));
+    assert!(close(p.coef[0].exp(), 4.0) && close(p.coef[1], 1.5));
+    assert_eq!(p.equation(), "y = 4x^1.5");
+    assert!(close(p.r2.unwrap(), 1.0));
+    assert_eq!(p.eval(-1.0), None, "power is undefined left of zero");
+    // Points the transform can't take are skipped, as Excel documents.
+    let skip = fit(TrendlineKind::Exponential, &[(1.0, 2.0f64.exp()), (2.0, 0.0), (3.0, -4.0), (4.0, 8.0f64.exp())]);
+    assert!(close(skip.coef[1], 2.0) && close(skip.coef[0], 0.0), "{:?}", skip.coef);
+    assert!(
+        crate::trend::fit_trendline(&Trendline { kind: TrendlineKind::Power, ..Trendline::default() }, &[(-1.0, 1.0), (0.0, 2.0), (3.0, 3.0)])
+            .is_none()
+    );
+}
+
+#[test]
+fn polynomial_trendlines_are_stable() {
+    let q = fit(TrendlineKind::Polynomial(2), &[0.0, 1.0, 2.0, 3.0, 4.0].map(|x| (x, x * x - 3.0 * x + 2.0)));
+    assert!(close(q.coef[0], 2.0) && close(q.coef[1], -3.0) && close(q.coef[2], 1.0), "{:?}", q.coef);
+    assert_eq!(q.equation(), "y = x² - 3x + 2");
+    // Year-valued x would make the raw normal equations hopelessly ill-conditioned.
+    let curve = |x: f64| {
+        let t = x - 2000.0;
+        0.001 * t.powi(6) - 0.02 * t.powi(5) + 0.1 * t.powi(3) - t + 7.0
+    };
+    let years: Vec<(f64, f64)> = (2001..=2012).map(|x| (f64::from(x), curve(f64::from(x)))).collect();
+    let six = fit(TrendlineKind::Polynomial(6), &years);
+    for x in [2001.0, 2006.5, 2012.0, 2014.0] {
+        let (got, want) = (six.eval(x).unwrap(), curve(x));
+        assert!((got - want).abs() <= 1e-6 * (1.0 + want.abs()), "{x}: {got} vs {want}");
+    }
+    assert!(six.r2.unwrap() > 0.999_999);
+}
+
+#[test]
+fn degenerate_trendlines_fit_nothing() {
+    let lin = |pts: &[(f64, f64)]| crate::trend::fit_trendline(&Trendline::default(), pts);
+    assert!(lin(&[]).is_none());
+    assert!(lin(&[(1.0, 1.0)]).is_none());
+    assert!(lin(&[(2.0, 1.0), (2.0, 5.0), (2.0, 3.0)]).is_none(), "all x equal is singular");
+    assert!(lin(&[(f64::NAN, 1.0), (1.0, f64::INFINITY), (2.0, 3.0)]).is_none());
+    assert!(
+        crate::trend::fit_trendline(&Trendline { kind: TrendlineKind::Polynomial(3), ..Trendline::default() }, &[(1.0, 1.0), (2.0, 4.0), (3.0, 9.0)])
+            .is_none()
+    );
+    assert!(
+        crate::trend::fit_trendline(&Trendline { kind: TrendlineKind::MovingAverage(2), ..Trendline::default() }, &[(1.0, 1.0), (2.0, 2.0)])
+            .is_none()
+    );
+    let flat = lin(&[(1.0, 4.0), (2.0, 4.0), (3.0, 4.0)]).unwrap();
+    assert_eq!((flat.equation(), flat.r2), ("y = 4".to_string(), None));
+    assert!(lin(&[(0.0, 1e300), (1.0, -1e300), (2.0, 1e300)]).is_none_or(|f| f.coef.iter().all(|c| c.is_finite())));
+}
+
+#[test]
+fn moving_average_and_labels() {
+    let pts = [(1.0, 1.0), (2.0, 2.0), (3.0, 6.0), (4.0, f64::NAN), (5.0, 4.0)];
+    assert_eq!(crate::trend::moving_average(&pts, 2), vec![(2.0, 1.5), (3.0, 4.0), (5.0, 5.0)]);
+    assert_eq!(crate::trend::moving_average(&pts, 3), vec![(3.0, 3.0), (5.0, 4.0)]);
+    assert!(crate::trend::moving_average(&pts, 9).is_empty());
+    assert_eq!(crate::trend::num_text(0.000012345), "1.2345E-05");
+    assert_eq!(crate::trend::num_text(-0.00001), "-1E-05");
+    assert_eq!(crate::trend::num_text(1234.56789), "1234.5679");
+    assert_eq!(crate::trend::auto_name(TrendlineKind::MovingAverage(3), "Sales"), "3 per. Mov. Avg. (Sales)");
+    assert_eq!(crate::trend::auto_name(TrendlineKind::Exponential, "Sales"), "Expon. (Sales)");
+}
+
+fn lines_of(prims: &[Prim], color: Rgba) -> Vec<&Vec<[f32; 2]>> {
+    prims
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Line { pts, color: c, .. } if *c == color => Some(pts),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn line_chart_draws_trendline_forecast_and_labels() {
+    let m = ApproxMeasure;
+    let tc: Rgba = [1, 2, 3, 255];
+    let mut s = series("Sales", &[9.0, 7.0, 5.0, 3.0], [10, 20, 30, 255], ChartKind::Line);
+    s.trendlines =
+        vec![TrendlineData { spec: Trendline { forward: 1.0, display_equation: true, display_r_squared: true, ..Trendline::default() }, color: tc }];
+    let d = ChartData { palette: vec![], categories: ["a", "b", "c", "d"].map(String::from).to_vec(), series: vec![s.clone()] };
+    let mut c = chart(ChartKind::Line);
+    c.legend = LegendPos::None; // keeps legend swatches out of the line counts
+    let prims = render(&c, &d, 600.0, 400.0, &m);
+    assert_sane(&prims, 600.0, 400.0);
+    let data = lines_of(&prims, [10, 20, 30, 255]);
+    let trend = lines_of(&prims, tc);
+    assert_eq!((data.len(), trend.len()), (1, 1));
+    let (d0, dn) = (data[0][0], data[0][3]);
+    let (t0, tn) = (trend[0][0], *trend[0].last().unwrap());
+    // Exact data: the trendline starts on the first point and runs through the last,
+    // then on one more category (the forecast slot).
+    assert!((t0[0] - d0[0]).abs() < 0.01 && (t0[1] - d0[1]).abs() < 0.01, "{t0:?} vs {d0:?}");
+    let step = (dn[0] - d0[0]) / 3.0;
+    assert!((tn[0] - (dn[0] + step)).abs() < 0.01, "forecast end {tn:?}, last point {dn:?}");
+    assert!(tn[1] > dn[1], "keeps falling past the data");
+    let t = texts(&prims);
+    assert!(t.contains(&"y = -2x + 11") && t.contains(&"R² = 1"), "{t:?}");
+    assert!(legend_entries(&chart(ChartKind::Line), &d).iter().any(|(n, col, sw)| n == "Linear (Sales)" && *col == tc && *sw == Swatch::Line));
+    // Not on chart kinds Excel doesn't offer trendlines on.
+    let pie = render(&chart(ChartKind::Pie), &d, 600.0, 400.0, &m);
+    assert!(lines_of(&pie, tc).is_empty());
+    // One point: nothing to fit, nothing drawn.
+    s.values.truncate(1);
+    let one = ChartData { palette: vec![], categories: vec!["a".into()], series: vec![s] };
+    assert!(lines_of(&render(&c, &one, 600.0, 400.0, &m), tc).is_empty());
+}
+
+#[test]
+fn scatter_trendlines_use_x_values_and_stay_in_the_plot() {
+    let m = ApproxMeasure;
+    let xs = [1.0, 2.0, 4.0, 8.0];
+    let mut s = series("P", &xs.map(|x| 4.0 * x * x), [10, 20, 30, 255], ChartKind::Scatter);
+    s.x = Some(xs.iter().map(|x| Some(*x)).collect());
+    let colors: [Rgba; 3] = [[1, 0, 0, 255], [2, 0, 0, 255], [3, 0, 0, 255]];
+    s.trendlines = vec![
+        TrendlineData {
+            spec: Trendline { kind: TrendlineKind::Power, backward: 0.5, display_equation: true, ..Trendline::default() },
+            color: colors[0],
+        },
+        // A steep exponential leaves the plot box and is clipped to it.
+        TrendlineData { spec: Trendline { kind: TrendlineKind::Exponential, forward: 30.0, ..Trendline::default() }, color: colors[1] },
+        TrendlineData { spec: Trendline { kind: TrendlineKind::MovingAverage(2), ..Trendline::default() }, color: colors[2] },
+    ];
+    let d = ChartData { palette: vec![], categories: vec![], series: vec![s] };
+    let mut c = chart(ChartKind::Scatter);
+    c.legend = LegendPos::None;
+    let prims = render(&c, &d, 600.0, 400.0, &m);
+    assert_sane(&prims, 600.0, 400.0);
+    for c in colors {
+        assert!(!lines_of(&prims, c).is_empty(), "{c:?} not drawn");
+    }
+    assert_eq!(lines_of(&prims, colors[2])[0].len(), 3, "moving average: one point per full window");
+    assert!(texts(&prims).contains(&"y = 4x^2"));
+}
+
 #[test]
 fn treemap_and_histogram_shapes() {
     let d = ChartData {
+        palette: vec![],
         categories: vec!["a".into(), "b".into(), "c".into(), "d".into()],
         series: vec![series("t", &[6.0, 6.0, 4.0, 3.0], [10, 20, 30, 255], ChartKind::Treemap)],
     };
@@ -654,12 +889,34 @@ fn treemap_and_histogram_shapes() {
     assert!((rects[0] / rects[3] - 2.0).abs() < 0.05, "{rects:?}");
 
     let vals: Vec<f64> = (0..100).map(|i| i as f64).collect();
-    let d = ChartData { categories: vec![], series: vec![series("h", &vals, [10, 20, 30, 255], ChartKind::Histogram)] };
+    let d = ChartData { palette: vec![], categories: vec![], series: vec![series("h", &vals, [10, 20, 30, 255], ChartKind::Histogram)] };
     let prims = render(&chart(ChartKind::Histogram), &d, 600.0, 400.0, &ApproxMeasure);
     let bins = prims.iter().filter(|p| matches!(p, Prim::Rect { fill: Some([10, 20, 30, 255]), .. })).count();
     assert_eq!(bins, 10);
 }
 
+#[test]
+fn histogram_boundary_values_match_interval_labels() {
+    let heights = |vals: &[f64]| -> Vec<f32> {
+        let d = ChartData { palette: vec![], categories: vec![], series: vec![series("h", vals, [10, 20, 30, 255], ChartKind::Histogram)] };
+        let prims = render(&chart(ChartKind::Histogram), &d, 600.0, 400.0, &ApproxMeasure);
+        prims.iter().filter_map(|p| if let Prim::Rect { h, fill: Some([10, 20, 30, 255]), .. } = p { Some(*h) } else { None }).collect()
+    };
+    // Labels are "[0, 7.5]" and "(7.5, 15.0]": 7.5 belongs to the first bar, so the counts are 2 and 1.
+    let h = heights(&[0.0, 7.5, 15.0]);
+    assert_eq!(h.len(), 2);
+    assert!((h[0] / h[1] - 2.0).abs() < 0.01, "{h:?}");
+    let h = heights(&[-15.0, -7.5, 0.0]);
+    assert!((h[0] / h[1] - 2.0).abs() < 0.01, "{h:?}");
+    // A value off the boundary still goes right: [0, 7.5] holds 1, (7.5, 15.0] holds 2.
+    let h = heights(&[0.0, 7.75, 15.0]);
+    assert!((h[1] / h[0] - 2.0).abs() < 0.01, "{h:?}");
+    // Five values, three bins [0,5] (5,10] (10,15]: counts 3, 1, 1.
+    let h = heights(&[0.0, 5.0, 5.0, 10.0, 15.0]);
+    assert_eq!(h.len(), 3);
+    assert!((h[0] / h[1] - 3.0).abs() < 0.01 && (h[1] - h[2]).abs() < 0.01, "{h:?}");
+}
+
 #[test]
 fn union_series_references() {
     let mut wb = Workbook::new();
@@ -685,3 +942,118 @@ fn union_series_references() {
     c.series[0].values = format!("{}Sheet1!$B$1,Sheet1!$B$2{}", "(".repeat(5000), ")".repeat(5000));
     let _ = resolve(&wb, 0, &c);
 }
+
+#[test]
+fn box_and_stock_charts_honour_the_gridlines_flag() {
+    // Horizontal full-width lines in the gridline colour are the value-axis gridlines.
+    let grid: Rgba = [217, 217, 217, 255];
+    let is_grid = |p: &Prim| match p {
+        Prim::Line { color, pts, .. } => *color == grid && pts.len() == 2 && pts[0][1] == pts[1][1] && pts[1][0] - pts[0][0] > 200.0,
+        _ => false,
+    };
+    let grids = |prims: &[Prim]| prims.iter().filter(|p| is_grid(p)).count();
+    for kind in [ChartKind::BoxWhisker, ChartKind::Stock, ChartKind::ColumnClustered] {
+        let mut d = sample(kind);
+        d.series.push(series("Close", &[10000.0, 12000.0, 9000.0, 14000.0, 20000.0, 16000.0], [90, 90, 90, 255], kind));
+        let mut c = chart(kind);
+        let on = render(&c, &d, 500.0, 350.0, &ApproxMeasure);
+        c.gridlines = false;
+        let off = render(&c, &d, 500.0, 350.0, &ApproxMeasure);
+        assert!(grids(&on) > 0, "{kind:?}: gridlines on must draw lines");
+        assert_eq!(grids(&off), 0, "{kind:?}: gridlines off must hide them");
+    }
+}
+
+#[test]
+fn funnel_value_labels_follow_the_data_labels_flag() {
+    let data = ChartData {
+        palette: vec![],
+        categories: vec!["a".into(), "b".into(), "c".into()],
+        series: vec![series("S", &[11111.0, 22222.0, 33333.0], [20, 96, 130, 255], ChartKind::Funnel)],
+    };
+    let mut c = chart(ChartKind::Funnel);
+    c.data_labels = false;
+    let off = render(&c, &data, 500.0, 350.0, &ApproxMeasure);
+    c.data_labels = true;
+    let on = render(&c, &data, 500.0, 350.0, &ApproxMeasure);
+    let values = ["$11,111", "$22,222", "$33,333"];
+    for v in values {
+        assert!(texts(&on).contains(&v), "{v} missing with labels on");
+        assert!(!texts(&off).contains(&v), "{v} drawn with labels off");
+    }
+    for cat in ["a", "b", "c"] {
+        assert!(texts(&off).contains(&cat));
+        assert!(texts(&on).contains(&cat));
+    }
+}
+
+#[test]
+fn pie_points_follow_workbook_theme() {
+    let mut wb = Workbook::new();
+    wb.theme.colors[4] = 0x4F6D8A;
+    wb.theme.colors[5] = 0x8AA1B8;
+    let mut c = chart(ChartKind::Pie);
+    c.series = vec![Series {
+        name: None,
+        categories: None,
+        values: "{5,3}".into(),
+        bubble_sizes: None,
+        color: None,
+        secondary: false,
+        kind: None,
+        smooth: false,
+        trendlines: Vec::new(),
+    }];
+    let d = resolve(&wb, 0, &c);
+    let expected = vec![series_color(&wb.theme, 0), series_color(&wb.theme, 1)];
+    assert_eq!(expected, vec![[0x4F, 0x6D, 0x8A, 0xFF], [0x8A, 0xA1, 0xB8, 0xFF]]);
+    let legend: Vec<Rgba> = legend_entries(&c, &d).iter().map(|e| e.1).collect();
+    assert_eq!(legend, expected);
+    let fills: Vec<Rgba> = render(&c, &d, 480.0, 288.0, &ApproxMeasure)
+        .iter()
+        .filter_map(|p| match p {
+            Prim::Wedge { fill, .. } => Some(*fill),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(fills, expected);
+    for kind in [ChartKind::Doughnut, ChartKind::Treemap, ChartKind::Sunburst] {
+        c.kind = kind;
+        let legend: Vec<Rgba> = legend_entries(&c, &d).iter().map(|e| e.1).collect();
+        assert_eq!(legend, expected, "{kind:?}");
+    }
+    // Past the 36-colour cycle the points keep following the workbook theme.
+    c.kind = ChartKind::Pie;
+    c.series[0].values = format!("{{{}}}", ["1"; 40].join(","));
+    let d = resolve(&wb, 0, &c);
+    let legend: Vec<Rgba> = legend_entries(&c, &d).iter().map(|e| e.1).collect();
+    assert_eq!(legend.len(), 40);
+    assert_eq!(legend.get(37), Some(&series_color(&wb.theme, 37)));
+    assert_ne!(series_color(&wb.theme, 37), series_color(&gridcraft_model::Theme::default(), 37));
+}
+
+#[test]
+fn area_charts_draw_source_value_labels_only_when_enabled() {
+    for kind in [ChartKind::Area, ChartKind::AreaStacked] {
+        let d = sample(kind);
+        let mut c = chart(kind);
+        c.data_labels = false;
+        let off = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+        c.data_labels = true;
+        let on = render(&c, &d, 640.0, 400.0, &ApproxMeasure);
+        let count = |p: &[Prim], v: &str| texts(p).iter().filter(|t| **t == v).count();
+        // One label per point: 3 series x 6 categories.
+        assert_eq!(texts(&on).len(), texts(&off).len() + 18, "{kind:?}");
+        for v in ["$12,000", "$38,000", "$9,000", "$27,000"] {
+            assert_eq!(count(&on, v), count(&off, v) + 1, "{kind:?}: {v}");
+        }
+        // Stacked areas label the source values, not cumulative totals (12,000 + 38,000).
+        assert_eq!(count(&on, "$50,000"), count(&off, "$50,000"), "{kind:?}: cumulative total shown");
+        let polys = |p: &[Prim]| p.iter().filter(|p| matches!(p, Prim::Polygon { .. })).cloned().collect::<Vec<_>>();
+        assert_eq!(polys(&on), polys(&off));
+        // The first series' labels are drawn after every area, so the next area can't cover them.
+        let last_poly = on.iter().rposition(|p| matches!(p, Prim::Polygon { .. }));
+        let first_label = on.iter().position(|p| matches!(p, Prim::Text { text, .. } if text == "$12,000"));
+        assert!(first_label > last_poly, "{kind:?}: label drawn under a later area");
+    }
+}

crates/chart/src/trend.rs

@@ -0,0 +1,278 @@
+//! Trendline maths: least-squares fits behind chart trendlines and moving averages.
+//!
+//! Exponential, logarithmic and power trendlines are linear fits of transformed data
+//! (`ln y` against `x`, `y` against `ln x`, `ln y` against `ln x`), the way Excel documents them;
+//! points where the transform is undefined (non-positive values) are skipped and R² is reported
+//! for the transformed fit. Polynomials solve the normal equations on centred, scaled x.
+
+use gridcraft_model::{Trendline, TrendlineKind};
+
+/// A fitted regression trendline.
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) struct TrendFit {
+    kind: TrendlineKind,
+    /// Coefficients `c0..=cd` of `Y = Σ cₖ·Xᵏ` in the transformed variables, for the equation.
+    pub coef: Vec<f64>,
+    /// The same polynomial in `u = (X - center) / scale`, for stable evaluation.
+    center: f64,
+    scale: f64,
+    a: Vec<f64>,
+    /// Coefficient of determination; `None` when undefined (all Y equal).
+    pub r2: Option<f64>,
+}
+
+/// Polynomial degree in the transformed variable; `None` for moving averages.
+fn degree(k: TrendlineKind) -> Option<usize> {
+    match k {
+        TrendlineKind::Linear | TrendlineKind::Exponential | TrendlineKind::Logarithmic | TrendlineKind::Power => Some(1),
+        TrendlineKind::Polynomial(o) => Some(usize::from(o.clamp(2, 6))),
+        TrendlineKind::MovingAverage(_) => None,
+    }
+}
+
+fn log_x(k: TrendlineKind) -> bool {
+    matches!(k, TrendlineKind::Logarithmic | TrendlineKind::Power)
+}
+
+fn log_y(k: TrendlineKind) -> bool {
+    matches!(k, TrendlineKind::Exponential | TrendlineKind::Power)
+}
+
+/// Fits `t` to the points `(x, y)`. `None` for moving averages and degenerate data (too few
+/// usable points, all x equal, a singular system, non-finite results).
+pub(crate) fn fit_trendline(t: &Trendline, pts: &[(f64, f64)]) -> Option<TrendFit> {
+    let kind = t.kind;
+    let d = degree(kind)?;
+    let data: Vec<(f64, f64)> = pts
+        .iter()
+        .filter(|(x, y)| x.is_finite() && y.is_finite() && (!log_x(kind) || *x > 0.0) && (!log_y(kind) || *y > 0.0))
+        .map(|&(x, y)| (if log_x(kind) { x.ln() } else { x }, if log_y(kind) { y.ln() } else { y }))
+        .collect();
+    if data.len() < 2 || data.len() <= d {
+        return None;
+    }
+    // Set Intercept applies to linear, exponential and polynomial trendlines; it fixes Y at x = 0.
+    let fixed = match kind {
+        TrendlineKind::Linear | TrendlineKind::Polynomial(_) => t.intercept,
+        TrendlineKind::Exponential => t.intercept.filter(|b| *b > 0.0).map(f64::ln),
+        _ => None,
+    }
+    .filter(|b| b.is_finite());
+    let n = data.len() as f64;
+    let center = if fixed.is_some() { 0.0 } else { data.iter().map(|p| p.0).sum::<f64>() / n };
+    let scale = data.iter().map(|p| (p.0 - center).abs()).fold(0.0f64, f64::max);
+    if !(scale.is_finite() && scale > 0.0) {
+        return None;
+    }
+    let first = usize::from(fixed.is_some());
+    let b0 = fixed.unwrap_or(0.0);
+    // Normal equations over the unknown powers `first..=d` of u.
+    let m = d + 1 - first;
+    let mut ata = vec![vec![0.0f64; m]; m];
+    let mut aty = vec![0.0f64; m];
+    for &(x, y) in &data {
+        let u = (x - center) / scale;
+        let pows: Vec<f64> = (first..=d).map(|k| u.powi(k as i32)).collect();
+        for (i, pi) in pows.iter().enumerate() {
+            if let Some(v) = aty.get_mut(i) {
+                *v += pi * (y - b0);
+            }
+            for (j, pj) in pows.iter().enumerate() {
+                if let Some(v) = ata.get_mut(i).and_then(|r| r.get_mut(j)) {
+                    *v += pi * pj;
+                }
+            }
+        }
+    }
+    let sol = solve(ata, aty)?;
+    let mut a = vec![b0; d + 1];
+    for (k, v) in sol.into_iter().enumerate() {
+        if let Some(slot) = a.get_mut(k + first) {
+            *slot = v;
+        }
+    }
+    let coef = expand(&a, center, scale)?;
+    let fit = TrendFit { kind, coef, center, scale, a, r2: None };
+    let mean = data.iter().map(|p| p.1).sum::<f64>() / n;
+    let (mut ss_res, mut ss_tot) = (0.0f64, 0.0f64);
+    for &(x, y) in &data {
+        ss_res += (y - fit.poly(x)).powi(2);
+        // A set intercept is LINEST(y - b, x, FALSE): the total sum of squares is not centred.
+        ss_tot += if fixed.is_some() { (y - b0).powi(2) } else { (y - mean).powi(2) };
+    }
+    let r2 = (ss_tot > 0.0 && ss_tot.is_finite() && ss_res.is_finite()).then(|| 1.0 - ss_res / ss_tot);
+    Some(TrendFit { r2, ..fit })
+}
+
+/// Gaussian elimination with partial pivoting; `None` when (nearly) singular.
+fn solve(mut a: Vec<Vec<f64>>, mut b: Vec<f64>) -> Option<Vec<f64>> {
+    let n = b.len();
+    let big = a.iter().flatten().fold(0.0f64, |m, v| m.max(v.abs()));
+    if !(big.is_finite() && big > 0.0) {
+        return None;
+    }
+    for col in 0..n {
+        let piv = (col..n).max_by(|&i, &j| {
+            let vi = a.get(i).and_then(|r| r.get(col)).map_or(0.0, |v| v.abs());
+            let vj = a.get(j).and_then(|r| r.get(col)).map_or(0.0, |v| v.abs());
+            vi.total_cmp(&vj)
+        })?;
+        a.swap(col, piv);
+        b.swap(col, piv);
+        let p = *a.get(col)?.get(col)?;
+        if !p.is_finite() || p.abs() <= big * 1e-13 {
+            return None;
+        }
+        let prow = a.get(col)?.clone();
+        let pb = *b.get(col)?;
+        for r in col + 1..n {
+            let row = a.get_mut(r)?;
+            let f = *row.get(col)? / p;
+            for (v, pv) in row.iter_mut().zip(&prow).skip(col) {
+                *v -= f * pv;
+            }
+            *b.get_mut(r)? -= f * pb;
+        }
+    }
+    let mut x = vec![0.0f64; n];
+    for r in (0..n).rev() {
+        let row = a.get(r)?;
+        let s: f64 = (r + 1..n).map(|c| row.get(c).copied().unwrap_or(0.0) * x.get(c).copied().unwrap_or(0.0)).sum();
+        let v = (b.get(r)? - s) / row.get(r)?;
+        *x.get_mut(r)? = v;
+    }
+    x.iter().all(|v| v.is_finite()).then_some(x)
+}
+
+/// Coefficients in X of `Σ aₖ·((X - c) / s)ᵏ` (binomial expansion).
+fn expand(a: &[f64], c: f64, s: f64) -> Option<Vec<f64>> {
+    let mut out = vec![0.0f64; a.len()];
+    for (k, ak) in a.iter().enumerate() {
+        let lead = ak / s.powi(k as i32);
+        let mut binom = 1.0f64;
+        for j in 0..=k {
+            // C(k, j) · (-c)^(k-j) · X^j
+            if let Some(o) = out.get_mut(j) {
+                *o += lead * binom * (-c).powi((k - j) as i32);
+            }
+            binom = binom * (k - j) as f64 / (j + 1) as f64;
+        }
+    }
+    out.iter().all(|v| v.is_finite()).then_some(out)
+}
+
+impl TrendFit {
+    /// The fitted polynomial at transformed `x` (Horner in u).
+    fn poly(&self, x: f64) -> f64 {
+        let u = (x - self.center) / self.scale;
+        self.a.iter().rev().fold(0.0, |acc, c| acc * u + c)
+    }
+
+    /// The trendline's y at `x`; `None` outside its domain (x ≤ 0 for log/power) or when not finite.
+    pub(crate) fn eval(&self, x: f64) -> Option<f64> {
+        let xx = if log_x(self.kind) { if x > 0.0 { x.ln() } else { return None } } else { x };
+        let p = self.poly(xx);
+        let y = if log_y(self.kind) { p.exp() } else { p };
+        y.is_finite().then_some(y)
+    }
+
+    /// Equation label text, e.g. `y = 2x + 1`, `y = 0.5x² - 2x + 1`, `y = 3e^(0.2x)`.
+    pub(crate) fn equation(&self) -> String {
+        let c0 = self.coef.first().copied().unwrap_or(0.0);
+        let c1 = self.coef.get(1).copied().unwrap_or(0.0);
+        match self.kind {
+            TrendlineKind::Exponential => format!("y = {}e^({}x)", num_text(c0.exp()), num_text(c1)),
+            TrendlineKind::Power => format!("y = {}x^{}", num_text(c0.exp()), num_text(c1)),
+            TrendlineKind::Logarithmic => terms(&[(c1, "ln(x)"), (c0, "")]),
+            _ => {
+                let parts: Vec<(f64, &str)> = self.coef.iter().enumerate().rev().map(|(k, c)| (*c, POWERS.get(k).copied().unwrap_or("x"))).collect();
+                terms(&parts)
+            }
+        }
+    }
+
+    /// R² label text, e.g. `R² = 0.9963`.
+    pub(crate) fn r_squared(&self) -> String {
+        match self.r2 {
+            Some(r) => format!("R² = {}", num_text(r)),
+            None => "R² = #N/A".into(),
+        }
+    }
+}
+
+const POWERS: [&str; 7] = ["", "x", "x²", "x³", "x⁴", "x⁵", "x⁶"];
+
+/// `y = a·t1 ± b·t2 …`, skipping terms whose coefficient shows as 0.
+fn terms(parts: &[(f64, &str)]) -> String {
+    let mut s = String::from("y = ");
+    let mut first = true;
+    for (c, t) in parts {
+        let txt = num_text(c.abs());
+        if txt == "0" {
+            continue;
+        }
+        let neg = *c < 0.0;
+        if first {
+            if neg {
+                s.push('-');
+            }
+        } else {
+            s.push_str(if neg { " - " } else { " + " });
+        }
+        // A unit coefficient on a power of x is left out: `y = x² - x + 1`.
+        if txt != "1" || t.is_empty() {
+            s.push_str(&txt);
+        }
+        s.push_str(t);
+        first = false;
+    }
+    if first {
+        s.push('0');
+    }
+    s
+}
+
+/// A coefficient as trendline labels show it: up to four decimals, scientific when tiny or huge.
+pub(crate) fn num_text(v: f64) -> String {
+    if !v.is_finite() {
+        return "#NUM!".into();
+    }
+    let a = v.abs();
+    if a == 0.0 {
+        return "0".into();
+    }
+    if !(1e-4..1e11).contains(&a) {
+        let s = format!("{v:.4E}");
+        let (mant, exp) = s.split_once('E').unwrap_or((s.as_str(), "0"));
+        let mant = trim_zeros(mant);
+        let e: i32 = exp.parse().unwrap_or(0);
+        return format!("{mant}E{}{:02}", if e < 0 { '-' } else { '+' }, e.unsigned_abs());
+    }
+    let s = trim_zeros(&format!("{v:.4}"));
+    if s == "-0" { "0".into() } else { s }
+}
+
+fn trim_zeros(s: &str) -> String {
+    if s.contains('.') { s.trim_end_matches('0').trim_end_matches('.').to_string() } else { s.to_string() }
+}
+
+/// Moving average of `period` consecutive points in plotted order: point `i` (from
+/// `period - 1`) is `(xᵢ, mean(yᵢ₋ₚ₊₁..=yᵢ))`. Empty when there are fewer points than `period`.
+pub(crate) fn moving_average(pts: &[(f64, f64)], period: u32) -> Vec<(f64, f64)> {
+    let p = period.clamp(2, 255) as usize;
+    let pts: Vec<(f64, f64)> = pts.iter().copied().filter(|(x, y)| x.is_finite() && y.is_finite()).collect();
+    pts.windows(p).filter_map(|w| w.last().map(|(x, _)| (*x, w.iter().map(|q| q.1).sum::<f64>() / p as f64))).collect()
+}
+
+/// Excel's automatic trendline name for the legend, e.g. `Linear (Sales)`.
+pub(crate) fn auto_name(kind: TrendlineKind, series: &str) -> String {
+    let k = match kind {
+        TrendlineKind::Linear => "Linear".to_string(),
+        TrendlineKind::Exponential => "Expon.".into(),
+        TrendlineKind::Logarithmic => "Log.".into(),
+        TrendlineKind::Polynomial(_) => "Poly.".into(),
+        TrendlineKind::Power => "Power".into(),
+        TrendlineKind::MovingAverage(p) => format!("{} per. Mov. Avg.", p.clamp(2, 255)),
+    };
+    format!("{k} ({series})")
+}

crates/core/src/date.rs

@@ -59,6 +59,14 @@ pub fn serial_from_unix_ms(ms: f64) -> f64 {
     25569.0 + ms / 86_400_000.0
 }
 
+/// Converts a 1900-system serial (as the clock supplies it) to the serial of the same instant in `sys`.
+pub fn serial_in_system(sys: DateSystem, serial_1900: f64) -> f64 {
+    match sys {
+        DateSystem::D1900 => serial_1900,
+        DateSystem::D1904 => serial_1900 - 1462.0,
+    }
+}
+
 pub fn civil_from_days(z: i64) -> (i32, u32, u32) {
     let z = z + 719468;
     let era = if z >= 0 { z } else { z - 146096 } / 146097;
@@ -95,6 +103,14 @@ pub fn days_in_month_in(sys: DateSystem, y: i32, m: u32) -> u32 {
     if sys == DateSystem::D1900 && y == 1900 && m == 2 { 29 } else { days_in_month(y, m) }
 }
 
+/// Last serial that is a valid date in a date system: 9999-12-31 (2958465 in the 1900 system, 2957003 in the 1904 system).
+pub fn max_serial(sys: DateSystem) -> i64 {
+    match sys {
+        DateSystem::D1900 => 2_958_465,
+        DateSystem::D1904 => 2_958_465 - 1462,
+    }
+}
+
 /// Serial for a date. Month and day overflow roll over like `DATE()` (month 13 = January next
 /// year, day 0 = last day of the previous month), in the date system's own calendar: in the 1900
 /// system February 1900 has 29 days, so `(1900, 2, 29)` and `(1900, 3, 0)` are serial 60.
@@ -117,7 +133,7 @@ pub fn serial_from_ymd(sys: DateSystem, year: i64, month: i64, day: i64) -> Opti
         DateSystem::D1904 => first - UNIX_1904_01_01,
     };
     let serial = first.checked_add(day)?.checked_sub(1)?;
-    if !(0..=2_958_465).contains(&serial) {
+    if !(0..=max_serial(sys)).contains(&serial) {
         return None;
     }
     Some(serial as f64)
@@ -125,7 +141,7 @@ pub fn serial_from_ymd(sys: DateSystem, year: i64, month: i64, day: i64) -> Opti
 
 /// Date/time from a serial. `None` for negative or too-large serials.
 pub fn datetime_from_serial(sys: DateSystem, serial: f64) -> Option<DateTime> {
-    if !serial.is_finite() || !(0.0..2_958_466.0).contains(&serial) {
+    if !serial.is_finite() || !(0.0..max_serial(sys) as f64 + 1.0).contains(&serial) {
         return None;
     }
     let mut day = serial.floor() as i64;
@@ -197,6 +213,10 @@ mod tests {
         assert_eq!(serial_from_ymd(s, 2000, 1, 1), Some(36526.0));
         assert_eq!(serial_from_ymd(s, 2026, 10, 7), Some(46302.0));
         assert_eq!(serial_from_ymd(s, 9999, 12, 31), Some(2958465.0));
+        assert_eq!(serial_from_ymd(DateSystem::D1904, 9999, 12, 31), Some(2957003.0));
+        assert_eq!(serial_from_ymd(DateSystem::D1904, 9999, 12, 32), None);
+        assert!(datetime_from_serial(DateSystem::D1904, 2957003.5).is_some());
+        assert!(datetime_from_serial(DateSystem::D1904, 2957004.0).is_none());
         assert_eq!(serial_from_ymd(s, 2020, 13, 1), serial_from_ymd(s, 2021, 1, 1));
         assert_eq!(serial_from_ymd(s, 2020, 3, 0), serial_from_ymd(s, 2020, 2, 29));
         assert_eq!(serial_from_ymd(s, 120, 1, 1), serial_from_ymd(s, 2020, 1, 1));

crates/core/src/parse.rs

@@ -41,7 +41,12 @@ pub fn parse_input(s: &str, sys: DateSystem) -> Parsed {
 
 /// Numeric text as arithmetic coerces it ("1,000", "50%", "$3", "1/2/2020", "10:00").
 pub fn parse_number_text(s: &str) -> Option<f64> {
-    parse_numeric(s.trim(), DateSystem::D1900).map(|(n, _)| n)
+    parse_number_text_in(s, DateSystem::D1900)
+}
+
+/// Like [`parse_number_text`], with date text read in the given workbook date system.
+pub fn parse_number_text_in(s: &str, sys: DateSystem) -> Option<f64> {
+    parse_numeric(s.trim(), sys).map(|(n, _)| n)
 }
 
 fn parse_numeric(t: &str, sys: DateSystem) -> Option<(f64, Option<&'static str>)> {
@@ -252,10 +257,14 @@ fn parse_date(t: &str, sys: DateSystem) -> Option<(f64, &'static str)> {
     // "Mar 4, 2026" / "March 4 2026" / "4 March 2026"
     let words: Vec<&str> = t.split([' ', ',']).filter(|w| !w.is_empty()).collect();
     if words.len() == 3 {
+        // Two-digit years follow the same 2029 rule as the dashed forms above.
+        let expand = |w: &str, y: i64| if w.len() <= 2 { if y < 30 { 2000 + y } else { 1900 + y } } else { y };
         if let (Some(m), Some(d), Some(y)) = (month_from_name(words[0]), num(words[1]), num(words[2])) {
+            let y = expand(words[2], y);
             return valid_ymd(sys, y, m as i64, d).map(|s| (s, "d-mmm-yy"));
         }
         if let (Some(d), Some(m), Some(y)) = (num(words[0]), month_from_name(words[1]), num(words[2])) {
+            let y = expand(words[2], y);
             return valid_ymd(sys, y, m as i64, d).map(|s| (s, "d-mmm-yy"));
         }
     }
@@ -317,6 +326,16 @@ mod tests {
         parse_input(s, DateSystem::D1900)
     }
 
+    #[test]
+    fn month_name_short_year() {
+        for s in ["Mar 4, 26", "Mar 4 26", "March 4 26", "4 March 26", "Mar 4, 2026"] {
+            assert_eq!(p(s).value, Value::Number(46085.0), "{s}");
+        }
+        assert_eq!(p("Mar 4, 99").value, p("Mar 4, 1999").value);
+        assert_eq!(p("Mar 4, 1776").value, Value::text("Mar 4, 1776"));
+        assert_eq!(p("Feb 30, 26").value, Value::text("Feb 30, 26"));
+    }
+
     #[test]
     fn numbers() {
         assert_eq!(p("42").value, Value::Number(42.0));

crates/core/src/value.rs

@@ -224,13 +224,17 @@ impl Value {
     /// Coercion to a number as arithmetic does it: empty = 0, TRUE = 1, numeric text parses
     /// (including dates, times, percentages and currency), other text = `#VALUE!`.
     pub fn to_number(&self) -> Result<f64, CellError> {
+        self.to_number_in(crate::DateSystem::D1900)
+    }
+    /// [`Value::to_number`] with date text read in the given workbook date system.
+    pub fn to_number_in(&self, sys: crate::DateSystem) -> Result<f64, CellError> {
         match self {
             Value::Empty => Ok(0.0),
             Value::Number(n) => Ok(*n),
             Value::Bool(b) => Ok(if *b { 1.0 } else { 0.0 }),
-            Value::Text(t) => crate::parse::parse_number_text(t).ok_or(CellError::Value),
+            Value::Text(t) => crate::parse::parse_number_text_in(t, sys).ok_or(CellError::Value),
             Value::Error(e) => Err(*e),
-            Value::Array(a) => a.data.first().map(|v| v.to_number()).unwrap_or(Ok(0.0)),
+            Value::Array(a) => a.data.first().map(|v| v.to_number_in(sys)).unwrap_or(Ok(0.0)),
         }
     }
     /// Coercion to text as `&` does it.

crates/engine/Cargo.toml

@@ -25,4 +25,5 @@ gridcraft-pdf = { workspace = true }
 image = { workspace = true }
 
 [dev-dependencies]
+gridcraft-xlsx = { workspace = true, features = ["test-support"] }
 zip = { workspace = true }

crates/engine/src/cf.rs

@@ -184,7 +184,7 @@ impl CfCache {
                 },
                 CfRule::TimePeriod { period, style } => match v.as_f64() {
                     Some(n) => {
-                        let today = gridcraft_calc::now_serial().floor();
+                        let today = gridcraft_core::date::serial_in_system(wb.date_system, gridcraft_calc::now_serial()).floor();
                         let d = n.floor();
                         let wd = gridcraft_core::date::datetime_from_serial(wb.date_system, today).map(|x| x.weekday as f64).unwrap_or(0.0);
                         let week_start = today - wd;

crates/engine/src/cmd/data.rs

@@ -122,7 +122,7 @@ pub fn specs() -> Vec<CommandSpec> {
 fn col_param(v: Option<&Json>, base: u32) -> Option<u32> {
     match v? {
         Json::String(s) => gridcraft_core::letters_to_col(s.trim_start_matches('$')),
-        Json::Number(n) => n.as_u64().map(|o| base + o as u32),
+        Json::Number(n) => n.as_u64().and_then(|o| u32::try_from(o).ok()).and_then(|o| base.checked_add(o)),
         _ => None,
     }
 }
@@ -198,27 +198,29 @@ fn sort(s: &mut Session, p: &Json) -> Result<Json> {
     let header = bool_param(p, "header").unwrap_or_else(|| guess_header(&d.wb, sh, r));
     let by_cols = str_param(p, "orientation") == Some("columns");
     let case = bool_param(p, "matchCase").unwrap_or(false);
-    let keys: Vec<SortKey> = p
-        .get("keys")
-        .and_then(Json::as_array)
-        .map(|a| {
-            a.iter()
-                .filter_map(|k| {
-                    let col = if by_cols {
-                        k.get("row").and_then(Json::as_u64).map(|r| r as u32 - 1).or_else(|| col_param(k.get("column"), r.start.row))?
-                    } else {
-                        col_param(k.get("column"), r.start.col)?
-                    };
-                    Some(SortKey {
-                        col,
-                        desc: k.get("order").and_then(Json::as_str) == Some("desc"),
-                        by: k.get("by").and_then(Json::as_str).unwrap_or("values").to_string(),
-                        list: k.get("customList").and_then(Json::as_array).map(|l| l.iter().filter_map(|x| x.as_str().map(str::to_string)).collect()),
-                    })
-                })
-                .collect()
-        })
-        .unwrap_or_default();
+    let mut keys: Vec<SortKey> = Vec::new();
+    for k in p.get("keys").and_then(Json::as_array).map(Vec::as_slice).unwrap_or_default() {
+        let col = if by_cols {
+            let row = match k.get("row").and_then(Json::as_u64) {
+                // Worksheet rows are 1-based; 0 (or a value past u32) has no coordinate.
+                Some(n) => {
+                    let row = u32::try_from(n).ok().and_then(|n| n.checked_sub(1));
+                    Some(row.ok_or_else(|| bad("data.sort", "sort key row must be 1 or greater"))?)
+                }
+                None => None,
+            };
+            row.or_else(|| col_param(k.get("column"), r.start.row))
+        } else {
+            col_param(k.get("column"), r.start.col)
+        };
+        let Some(col) = col else { continue };
+        keys.push(SortKey {
+            col,
+            desc: k.get("order").and_then(Json::as_str) == Some("desc"),
+            by: k.get("by").and_then(Json::as_str).unwrap_or("values").to_string(),
+            list: k.get("customList").and_then(Json::as_array).map(|l| l.iter().filter_map(|x| x.as_str().map(str::to_string)).collect()),
+        });
+    }
     if keys.is_empty() {
         s.ui_requests.push(crate::UiRequest::Dialog("sort".into(), json!({"range": r.a1(), "header": header})));
         return ok();
@@ -444,6 +446,9 @@ fn toggle_filter(s: &mut Session, p: &Json) -> Result<Json> {
             let sh = cx.sheet_mut(sheet)?;
             if let Some(t) = sh.tables.iter_mut().find(|t| t.name == name) {
                 t.filter_button = !t.filter_button;
+                if !t.filter_button {
+                    t.filter.clear();
+                }
             }
             Ok(Json::Null)
         });
@@ -451,14 +456,24 @@ fn toggle_filter(s: &mut Session, p: &Json) -> Result<Json> {
     if has {
         return edit(s, |cx| {
             let sh = cx.sheet_mut(sheet)?;
+            // Reveal only rows the filter hid; rows hidden by hand or by a collapsed group stay hidden.
+            let filtered: Vec<u32> = sh.rows.keys().copied().filter(|r| sh.is_row_filtered(*r)).collect();
             sh.autofilter = None;
-            for info in sh.rows.values_mut() {
-                info.hidden = false;
+            for r in filtered {
+                if let Some(info) = sh.rows.get_mut(&r) {
+                    info.hidden = false;
+                }
             }
             cx.structural = true;
             Ok(json!({"filter": false}))
         });
     }
+    install_filter(s, p)
+}
+
+/// Turn a sheet AutoFilter on over `p.range`, or over the data range of the selection.
+fn install_filter(s: &mut Session, p: &Json) -> Result<Json> {
+    let sheet = s.doc()?.wb.active_sheet;
     let mut r = data_range(s, p)?;
     // A selected header row filters the data below it (#201).
     if p.get("range").is_none() && r.height() == 1 {
@@ -481,11 +496,16 @@ fn filter_by(s: &mut Session, p: &Json) -> Result<Json> {
     let af = match &sh.autofilter {
         Some(a) => a.clone(),
         None => {
-            toggle_filter(s, &json!({}))?;
+            install_filter(s, &json!({}))?;
             s.doc()?.wb.sheet(sheet).and_then(|sh| sh.autofilter.clone()).ok_or_else(|| EngineError::Other("no filter".into()))?
         }
     };
-    let col = col_param(p.get("column"), af.range.start.col).ok_or_else(|| bad("data.filterBy", "missing `column`"))?;
+    let col = match col_param(p.get("column"), af.range.start.col) {
+        Some(c) => c,
+        // A number too large to be a column is outside the filter range, not a missing parameter.
+        None if p.get("column").is_some_and(|v| v.as_u64().is_some()) => return Err(bad("data.filterBy", "column outside the filter range")),
+        None => return Err(bad("data.filterBy", "missing `column`")),
+    };
     if col < af.range.start.col || col > af.range.end.col {
         return Err(bad("data.filterBy", "column outside the filter range"));
     }
@@ -567,19 +587,28 @@ pub(crate) fn apply_filter(wb: &mut Workbook, sheet: usize) {
     let Some(af) = sh.autofilter.clone() else { return };
     let r = af.range;
     let mut hide = Vec::new();
-    // Precompute per-column numbers for top10/average.
-    let mut col_stats: std::collections::HashMap<u32, (Vec<f64>, f64)> = std::collections::HashMap::new();
-    for (off, c) in &af.criteria {
+    // Precompute per-criterion top10 threshold and average once, not per row.
+    let mut col_stats: std::collections::HashMap<usize, (Option<f64>, f64)> = std::collections::HashMap::new();
+    for (i, (off, c)) in af.criteria.iter().enumerate() {
         if matches!(c, FilterCriterion::Top10 { .. } | FilterCriterion::AboveAverage(_)) {
             let col = r.start.col + off;
-            let nums: Vec<f64> = (r.start.row + 1..=r.end.row).filter_map(|row| sh.value(CellRef::new(row, col)).as_f64()).collect();
+            let mut nums: Vec<f64> = (r.start.row + 1..=r.end.row).filter_map(|row| sh.value(CellRef::new(row, col)).as_f64()).collect();
             let avg = if nums.is_empty() { 0.0 } else { nums.iter().sum::<f64>() / nums.len() as f64 };
-            col_stats.insert(*off, (nums, avg));
+            let thr = match c {
+                FilterCriterion::Top10 { bottom, percent, count } => {
+                    nums.sort_by(|a, b| if *bottom { a.partial_cmp(b) } else { b.partial_cmp(a) }.unwrap_or(Ordering::Equal));
+                    let k = if *percent { ((nums.len() as f64) * (*count as f64) / 100.0).ceil() as usize } else { *count as usize };
+                    let k = k.clamp(1, nums.len().max(1));
+                    nums.get(k - 1).copied()
+                }
+                _ => None,
+            };
+            col_stats.insert(i, (thr, avg));
         }
     }
     for row in r.start.row + 1..=r.end.row {
         let mut visible = true;
-        for (off, crit) in &af.criteria {
+        for (i, (off, crit)) in af.criteria.iter().enumerate() {
             let c = CellRef::new(row, r.start.col + off);
             let v = sh.value(c);
             let text = crate::display::cell_text(wb, sh, c);
@@ -601,18 +630,14 @@ pub(crate) fn apply_filter(wb: &mut Workbook, sheet: usize) {
                         None => x,
                     }
                 }
-                FilterCriterion::Top10 { bottom, percent, count } => match (v.as_f64(), col_stats.get(off)) {
-                    (Some(n), Some((nums, _))) => {
-                        let mut sorted = nums.clone();
-                        sorted.sort_by(|a, b| if *bottom { a.partial_cmp(b) } else { b.partial_cmp(a) }.unwrap_or(Ordering::Equal));
-                        let k = if *percent { ((sorted.len() as f64) * (*count as f64) / 100.0).ceil() as usize } else { *count as usize };
-                        let k = k.clamp(1, sorted.len().max(1));
-                        let thr = sorted.get(k - 1).copied().unwrap_or(n);
+                FilterCriterion::Top10 { bottom, .. } => match (v.as_f64(), col_stats.get(&i)) {
+                    (Some(n), Some((thr, _))) => {
+                        let thr = thr.unwrap_or(n);
                         if *bottom { n <= thr } else { n >= thr }
                     }
                     _ => false,
                 },
-                FilterCriterion::AboveAverage(above) => match (v.as_f64(), col_stats.get(off)) {
+                FilterCriterion::AboveAverage(above) => match (v.as_f64(), col_stats.get(&i)) {
                     (Some(n), Some((_, avg))) => {
                         if *above {
                             n > *avg
@@ -624,6 +649,8 @@ pub(crate) fn apply_filter(wb: &mut Workbook, sheet: usize) {
                 },
                 FilterCriterion::FillColor(col) => wb.styles.get(sh.style_id(c)).fill.fg == *col,
                 FilterCriterion::FontColor(col) => wb.styles.get(sh.style_id(c)).font.color == *col,
+                // Icons are not evaluated here: the row keeps its current visibility.
+                FilterCriterion::Icon { .. } => !sh.is_row_hidden(row),
             };
             if !ok {
                 visible = false;
@@ -891,7 +918,7 @@ fn subtract_range(r: RangeRef, cut: &RangeRef) -> Vec<RangeRef> {
 }
 
 /// Removes the cells of `cuts` from every validation, keeping the rest of each rule's ranges.
-fn remove_validation_cells(validations: &mut Vec<Validation>, cuts: &[RangeRef]) {
+pub(super) fn remove_validation_cells(validations: &mut Vec<Validation>, cuts: &[RangeRef]) {
     for dv in validations.iter_mut() {
         for cut in cuts {
             dv.ranges = dv.ranges.iter().flat_map(|r| subtract_range(*r, cut)).collect();
@@ -1041,6 +1068,18 @@ fn formula_at(f: &str, first: CellRef, at: CellRef) -> String {
     }
 }
 
+/// Moves the relative references of a rule formula written for `first` so it reads the same cells from `to`
+/// (pasting a rule); text without relative references (constants, literal lists) stays as typed.
+pub(super) fn move_rule_formula(f: &str, first: CellRef, to: CellRef) -> String {
+    if first == to {
+        return f.to_string();
+    }
+    let moved = formula_at(f, first, to);
+    let has_relative = gridcraft_formula::parse(f.trim_start_matches('=')).is_ok_and(|e| gridcraft_formula::print(&e) != moved);
+    let eq = if f.starts_with('=') { "=" } else { "" };
+    if has_relative { format!("{eq}{moved}") } else { f.to_string() }
+}
+
 fn compare_op(op: CfOperator, n: f64, a: Option<f64>, b: Option<f64>) -> bool {
     let Some(a) = a else { return false };
     match op {
@@ -1124,6 +1163,7 @@ fn group(s: &mut Session, p: &Json, on: bool) -> Result<Json> {
         {
             e.collapsed = false;
         }
+        cx.structural = true; // ungrouping reveals hidden rows: SUBTOTAL(10x) depends on it
         Ok(Json::Null)
     })
 }
@@ -1273,6 +1313,38 @@ fn subtotal(s: &mut Session, p: &Json) -> Result<Json> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn filter_by_huge_numeric_column_is_rejected_not_overflowed() {
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("range.setValues", json!({"range": "B1", "values": [["Name", "Qty"], ["a", 1], ["b", 2]]})).unwrap();
+        s.execute("data.filter", json!({"range": "B1:C3"})).unwrap();
+        for col in [json!(2), json!(u64::from(u32::MAX)), json!(u64::MAX)] {
+            let err = s.execute("data.filterBy", json!({"column": col, "values": ["a"]})).unwrap_err();
+            assert!(err.to_string().contains("column outside the filter range"), "{col}: {err}");
+        }
+        let ok = s.execute("data.filterBy", json!({"column": 0, "values": ["a"]})).unwrap();
+        assert_eq!(ok["hiddenRows"], json!(1));
+    }
+
+    #[test]
+    fn filter_by_inside_a_table_installs_the_autofilter_and_keeps_the_button() {
+        for sel in [json!({"cell": "A1"}), json!({"cell": "A2"}), json!({"range": "A1:A3"})] {
+            let mut s = Session::new();
+            s.new_workbook();
+            s.execute("range.setValues", json!({"range": "A1", "values": [["H"], ["a"], ["b"]]})).unwrap();
+            s.execute("insert.table", json!({"range": "A1:A3", "header": true})).unwrap();
+            s.execute("selection.set", sel.clone()).unwrap();
+            s.execute("data.filterBy", json!({"column": "A", "values": ["a"]})).unwrap();
+            let sh = s.doc().unwrap().wb.active().unwrap();
+            assert_eq!(sh.autofilter.as_ref().map(|a| a.range.a1()), Some("A1:A3".to_string()), "{sel}");
+            assert!(sh.tables[0].filter_button, "{sel}");
+            assert!(!sh.is_row_hidden(1), "{sel}");
+            assert!(sh.is_row_hidden(2), "{sel}");
+            assert_eq!(sh.value(CellRef::new(2, 0)).display(), "b", "{sel}");
+        }
+    }
+
     #[test]
     fn partial_validation_edits_keep_the_rest_of_the_old_rule() {
         let mut s = Session::new();
@@ -1295,6 +1367,45 @@ mod tests {
         assert!(!ok(&mut s, "B1", "150"));
     }
 
+    #[test]
+    fn removing_an_autofilter_keeps_manually_hidden_and_collapsed_rows() {
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("range.setValues", json!({"range": "A1", "values": [["H"], ["a"], ["b"], ["c"]]})).unwrap();
+        s.execute("range.setValues", json!({"range": "A10", "values": [["z"]]})).unwrap();
+        s.execute("data.group", json!({"rows": "2:4"})).unwrap();
+        s.execute("data.hideDetail", json!({"rows": "2:4"})).unwrap();
+        s.execute("home.hideRows", json!({"rows": "10:10"})).unwrap();
+        let hidden = |s: &Session| -> Vec<u32> {
+            let sh = s.doc().unwrap().wb.active().unwrap();
+            sh.rows.iter().filter(|(_, l)| l.hidden).map(|(r, _)| *r).collect()
+        };
+        let before = hidden(&s);
+        assert_eq!(before, [1, 2, 3, 9]);
+        s.execute("data.filter", json!({"range": "A1:A4"})).unwrap();
+        s.execute("data.filter", json!({"range": "A1:A4"})).unwrap();
+        assert!(s.doc().unwrap().wb.active().unwrap().autofilter.is_none());
+        assert_eq!(hidden(&s), before);
+        assert_eq!(row_state(&s, 4..=4), [(false, true)]);
+    }
+
+    #[test]
+    fn table_dropdown_setup_outside_the_table_keeps_manually_hidden_rows() {
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("range.setValues", json!({"range": "A1", "values": [["H"], ["a"], ["b"], ["c"]]})).unwrap();
+        s.execute("range.setValues", json!({"range": "A10", "values": [["z"]]})).unwrap();
+        s.execute("insert.table", json!({"range": "A1:A4", "header": true})).unwrap();
+        s.execute("home.hideRows", json!({"rows": "3:3"})).unwrap();
+        s.execute("home.hideRows", json!({"rows": "10:10"})).unwrap();
+        s.execute("selection.set", json!({"range": "E1"})).unwrap();
+        // The table filter dropdown installs an AutoFilter on demand by toggling `data.filter` twice.
+        s.execute("data.filter", json!({"range": "A1:A4"})).unwrap();
+        s.execute("data.filter", json!({"range": "A1:A4"})).unwrap();
+        let sh = s.doc().unwrap().wb.active().unwrap();
+        assert_eq!(sh.rows.iter().filter(|(_, l)| l.hidden).map(|(r, _)| *r).collect::<Vec<_>>(), [2, 9]);
+    }
+
     /// Rows 5:8 grouped, with 6:7 grouped again inside (0-based 4..=7 and 5..=6).
     fn nested_rows() -> Session {
         let mut s = Session::new();
@@ -1370,6 +1481,18 @@ mod tests {
         assert_eq!(sc("data.ungroup"), Some("Alt+Shift+Left"));
     }
 
+    #[test]
+    fn column_sort_rejects_row_key_zero_without_panicking() {
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("cell.set", json!({"cell": "A1", "input": "2"})).unwrap();
+        for row in [0u64, 1 << 32] {
+            let params = json!({"range": "A1:B2", "header": false, "orientation": "columns", "keys": [{"row": row}]});
+            let err = s.execute("data.sort", params).unwrap_err();
+            assert!(matches!(err, EngineError::BadParams { .. }), "row {row}: {err:?}");
+        }
+    }
+
     #[test]
     fn split() {
         assert_eq!(split_delimited("a,b,,c", &[','], false, '"'), ["a", "b", "", "c"]);

crates/engine/src/cmd/edit.rs

@@ -150,6 +150,7 @@ pub(crate) fn input_to_cell(input: &str, sheet: usize, at: CellRef, wb: &mut gri
         }
         let expr = parsed.map_err(|e| EngineError::Other(format!("There's a problem with this formula: {e}")))?;
         let expr = wb.name_call_case(expr);
+        check_arg_counts(&expr)?;
         let mut cell = Cell::formula(Formula::from_expr(expr));
         cell.style = style;
         // Formulas whose result is a date/time get a format from functions like TODAY().
@@ -190,17 +191,36 @@ pub(crate) fn input_to_cell(input: &str, sheet: usize, at: CellRef, wb: &mut gri
     Ok(Some(Cell { value: parsed.value, formula: None, style }))
 }
 
+/// Like Excel, a formula that calls a built-in function with too few or too many arguments is
+/// refused when it's entered, rather than stored to show `#VALUE!`. Functions the registry doesn't
+/// hold (special forms like LET, LAMBDA, OFFSET, INDIRECT, SUBTOTAL), defined LAMBDA names and
+/// unknown functions are skipped.
+fn check_arg_counts(expr: &gridcraft_formula::Expr) -> Result<()> {
+    let mut bad = None;
+    expr.walk(&mut |e| {
+        if bad.is_none()
+            && let gridcraft_formula::Expr::Call(name, args) = e
+            && let Some(spec) = gridcraft_functions::lookup(name)
+            && !spec.accepts(args.len())
+        {
+            let few = args.len() < spec.min_args;
+            bad = Some(format!("{} has too {} arguments. Use {}", spec.name, if few { "few" } else { "many" }, spec.signature));
+        }
+    });
+    match bad {
+        Some(msg) => Err(EngineError::Other(msg)),
+        None => Ok(()),
+    }
+}
+
 fn cell_set(s: &mut Session, p: &Json) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     let at = match cell_param_on(s, p, "cell", sheet)? {
         Some(c) => c,
         None => s.doc()?.selection.active,
     };
-    let input = str_param(p, "input")
-        .or_else(|| str_param(p, "value"))
-        .map(str::to_string)
-        .or_else(|| p.get("value").map(json_to_input))
-        .ok_or_else(|| bad("cell.set", "missing `input` (or `value`)"))?;
+    // Both spellings take a string, number or boolean, as typed (#697).
+    let input = p.get("input").or_else(|| p.get("value")).map(json_to_input).ok_or_else(|| bad("cell.set", "missing `input` (or `value`)"))?;
     let array = bool_param(p, "array").unwrap_or(false);
     let d = s.doc()?;
     if let Some(sh) = d.wb.sheet(sheet)
@@ -210,10 +230,17 @@ fn cell_set(s: &mut Session, p: &Json) -> Result<Json> {
     {
         return Err(EngineError::Other(m));
     }
+    let active_sheet = s.doc()?.wb.active_sheet;
     edit(s, |cx| {
         if array {
-            // Legacy Ctrl+Shift+Enter array formula over the selection.
-            let range = cx.sel.current();
+            // Legacy Ctrl+Shift+Enter array formula over the selection, when the selection holds
+            // the cell; a cell elsewhere (or on another sheet) gets a one-cell array.
+            let selected = cx.sel.current();
+            let range = if sheet == active_sheet && selected.contains(at) { selected } else { RangeRef::cell(at) };
+            // A table header can't hold an array's value, and a table resizes under it.
+            if !range.is_single() && cx.wb.sheet(sheet).is_some_and(|sh| sh.tables.iter().any(|t| t.range.intersects(&range))) {
+                return Err(EngineError::Other("Multi-cell array formulas aren't allowed in tables.".into()));
+            }
             let mut cell = input_to_cell(&input, sheet, range.start, &mut cx.wb)?.unwrap_or_default();
             if let Some(f) = cell.formula.as_mut() {
                 std::sync::Arc::make_mut(f).array = Some(range);
@@ -390,14 +417,7 @@ fn selection_move(s: &mut Session, p: &Json) -> Result<Json> {
     let Some(sheet) = d.wb.active() else { return Err(EngineError::NoDocument) };
     let sel = &mut d.selection;
     // Extension moves the far corner, not the active cell.
-    let from = if extend {
-        let r = sel.current();
-        let far_row = if sel.anchor.row == r.start.row { r.end.row } else { r.start.row };
-        let far_col = if sel.anchor.col == r.start.col { r.end.col } else { r.start.col };
-        CellRef::new(far_row, far_col)
-    } else {
-        sel.active
-    };
+    let from = if extend { sel.moving_end() } else { sel.active };
     // Skip hidden rows/columns and step over merged areas.
     let mut to = if jmp {
         jump(sheet, from, dr.signum(), dc.signum())
@@ -483,7 +503,7 @@ fn select_col(s: &mut Session, _: &Json) -> Result<Json> {
     Ok(json!({"selection": d.selection.a1()}))
 }
 
-fn go_to(s: &mut Session, p: &Json) -> Result<Json> {
+pub(super) fn go_to(s: &mut Session, p: &Json) -> Result<Json> {
     let Some(reference) = str_param(p, "reference").or_else(|| str_param(p, "range")) else { return Err(bad("edit.goTo", "missing `reference`")) };
     // A defined name or table?
     let d = s.doc()?;
@@ -578,6 +598,7 @@ fn undo(s: &mut Session, p: &Json) -> Result<Json> {
     let steps = u32_param(p, "steps").unwrap_or(1).max(1);
     let d = s.doc_mut()?;
     let mut label = String::new();
+    let now = d.wb.clone();
     for _ in 0..steps {
         let Some(e) = d.undo.pop() else { break };
         let cur = crate::HistoryEntry { label: e.label.clone(), wb: d.wb.clone(), selection: d.selection.clone() };
@@ -586,6 +607,7 @@ fn undo(s: &mut Session, p: &Json) -> Result<Json> {
         d.wb = e.wb;
         d.selection = e.selection;
     }
+    super::extra::keep_watch_list(&now, &mut d.wb);
     d.calc.rebuild(&d.wb);
     d.revision += 1;
     Ok(json!({"undone": label}))
@@ -595,6 +617,7 @@ fn redo(s: &mut Session, p: &Json) -> Result<Json> {
     let steps = u32_param(p, "steps").unwrap_or(1).max(1);
     let d = s.doc_mut()?;
     let mut label = String::new();
+    let now = d.wb.clone();
     for _ in 0..steps {
         let Some(e) = d.redo.pop() else { break };
         let cur = crate::HistoryEntry { label: e.label.clone(), wb: d.wb.clone(), selection: d.selection.clone() };
@@ -603,6 +626,7 @@ fn redo(s: &mut Session, p: &Json) -> Result<Json> {
         d.wb = e.wb;
         d.selection = e.selection;
     }
+    super::extra::keep_watch_list(&now, &mut d.wb);
     d.calc.rebuild(&d.wb);
     d.revision += 1;
     Ok(json!({"redone": label}))
@@ -972,7 +996,9 @@ fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
                                     e
                                 };
                                 let mut moved = Formula::from_expr(e);
-                                moved.array = f.array;
+                                // The array range moves with its formula.
+                                let (dr, dc) = (dest.row as i64 - sc.row as i64, dest.col as i64 - sc.col as i64);
+                                moved.array = f.array.and_then(|a| Some(RangeRef::new(a.start.offset(dr, dc)?, a.end.offset(dr, dc)?)));
                                 return Some(std::sync::Arc::new(moved));
                             }
                             let moved =
@@ -1075,6 +1101,20 @@ fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
                                 }
                             }
                         }
+                        // The copied cell's validation rule replaces whatever rule the destination had.
+                        if !link && matches!(what, What::All | What::AllExceptBorders | What::Validation) {
+                            let rule = src_sheet.validations.iter().find(|dv| dv.ranges.iter().any(|r| r.contains(sc))).cloned();
+                            let sh = cx.sheet_mut(dest_sheet)?;
+                            super::data::remove_validation_cells(&mut sh.validations, &[RangeRef::new(dest, dest)]);
+                            if let Some(mut dv) = rule {
+                                // Relative references move with the rule, as pasted formulas do.
+                                let first = dv.ranges.first().map_or(sc, |r| r.start);
+                                dv.f1 = super::data::move_rule_formula(&dv.f1, first, dest);
+                                dv.f2 = dv.f2.map(|f| super::data::move_rule_formula(&f, first, dest));
+                                dv.ranges = vec![RangeRef::new(dest, dest)];
+                                sh.validations.push(dv);
+                            }
+                        }
                         match what {
                             What::Comments => {
                                 if let Some(cm) = src_sheet.comments.get(&sc).cloned() {
@@ -1139,6 +1179,10 @@ fn paste_special(s: &mut Session, p: &Json) -> Result<Json> {
 
 /// Applies a reference adjustment to every cell formula and defined name in the workbook.
 pub(crate) fn rewrite_all_formulas(wb: &mut gridcraft_model::Workbook, target: &str, e: &gridcraft_formula::adjust::Edit) {
+    use gridcraft_formula::adjust::Edit;
+    // Rows and columns inserted or deleted on the target sheet move its legacy array ranges too
+    // (a cut moves its arrays itself).
+    let moves_arrays = matches!(e, Edit::Insert { .. } | Edit::Delete { .. } | Edit::InsertCells { .. } | Edit::DeleteCells { .. });
     for si in 0..wb.sheets.len() {
         let host = wb.sheets.get(si).map(|s| s.name.clone()).unwrap_or_default();
         let keys: Vec<(CellRef, std::sync::Arc<Formula>)> =
@@ -1146,16 +1190,21 @@ pub(crate) fn rewrite_all_formulas(wb: &mut gridcraft_model::Workbook, target: &
         if keys.is_empty() {
             continue;
         }
+        let on_target = moves_arrays && host.eq_ignore_ascii_case(target);
         let Some(sheet) = wb.sheet_mut(si) else { continue };
         for (c, f) in keys {
             let Some(expr) = f.expr() else { continue };
             let new = gridcraft_formula::adjust::adjust(expr, &host, target, e);
             let text = gridcraft_formula::print(&new);
-            if text != f.text
+            let array = match f.array {
+                Some(a) if on_target => super::sheet::map_range(a, e),
+                a => a,
+            };
+            if (text != f.text || array != f.array)
                 && let Some(cell) = sheet.cells.get_mut(c)
             {
                 let mut nf = Formula::from_expr(new);
-                nf.array = f.array;
+                nf.array = array;
                 cell.formula = Some(std::sync::Arc::new(nf));
             }
         }
@@ -1538,6 +1587,23 @@ fn begin_edit(s: &mut Session, _: &Json) -> Result<Json> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn cell_set_takes_numbers_for_input_and_value() {
+        // #697: a JSON number for `input` used to clear the cell instead of entering it.
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("cell.set", json!({"cell": "A1", "input": 123.5})).unwrap();
+        s.execute("cell.set", json!({"cell": "A2", "value": 77})).unwrap();
+        s.execute("cell.set", json!({"cell": "A3", "input": true})).unwrap();
+        s.execute("cell.set", json!({"cell": "A4", "input": "=A1+A2"})).unwrap();
+        let get = |s: &mut Session, a: &str| s.execute("cell.get", json!({"cell": a})).unwrap();
+        assert_eq!(get(&mut s, "A1")["value"], json!(123.5));
+        assert_eq!(get(&mut s, "A2")["value"], json!(77.0));
+        assert_eq!(get(&mut s, "A3")["value"], json!(true));
+        assert_eq!(get(&mut s, "A4")["value"], json!(200.5));
+        assert!(s.execute("cell.set", json!({"cell": "A5"})).is_err());
+    }
+
     #[test]
     fn legacy_array_entry() {
         let mut s = Session::new();
@@ -1554,6 +1620,22 @@ mod tests {
         assert_eq!(bar.as_deref(), Some("{=B2:B3*2}"));
     }
 
+    #[test]
+    fn an_array_entered_outside_the_selection_covers_only_its_cell() {
+        // Found by the command-sequence fuzzer: the array took the selection's range even with
+        // `cell` elsewhere (or on another sheet), so its formula sat outside its own range and the
+        // selected cells were wiped.
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("cell.set", json!({"cell": "K20", "input": "keep"})).unwrap();
+        s.execute("selection.set", json!({"range": "K20:K22"})).unwrap();
+        s.execute("cell.set", json!({"cell": "H5", "input": "=1+1", "array": true})).unwrap();
+        let sh = s.doc().unwrap().wb.active().unwrap();
+        let f = sh.cell(CellRef::parse("H5").unwrap()).and_then(|c| c.formula.clone()).unwrap();
+        assert_eq!(f.array, Some(RangeRef::parse("H5").unwrap()));
+        assert_eq!(sh.value(CellRef::parse("K20").unwrap()), Value::text("keep"));
+    }
+
     #[test]
     fn wildcards() {
         assert!(wildcard("hello", "h*o"));

crates/engine/src/cmd/extra.rs

@@ -15,7 +15,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Add Chart Element",
             ["Chart Design", "Chart Layouts"],
             None,
-            "{chart?, element: title|legend|dataLabels|gridlines|axisTitles|smooth, on?: bool, position?: bottom|top|left|right}",
+            "{chart?, element: title|legend|dataLabels|gridlines|axisTitles|smooth|trendline, on?: bool, position?: bottom|top|left|right; trendline: series?: index (default all), type?: linear|exponential|linearForecast|movingAverage|logarithmic|power|polynomial, order?: 2..6, period?: 2..255, forward?, backward?, displayEquation?, displayRSquared?}",
             has_doc,
             add_element
         ),
@@ -316,12 +316,68 @@ fn add_element(s: &mut Session, p: &Json) -> Result<Json> {
                     s.smooth = on;
                 }
             }
+            "trendline" => {
+                let only = u32_param(p, "series").map(|i| i as usize);
+                if only.is_some_and(|i| i >= c.series.len()) {
+                    return Err(bad("chart.addElement", "no such series"));
+                }
+                let targets: Vec<usize> = (0..c.series.len()).filter(|i| only.is_none_or(|o| o == *i)).collect();
+                if !on {
+                    for i in targets {
+                        if let Some(se) = c.series.get_mut(i) {
+                            se.trendlines.clear();
+                        }
+                    }
+                    return Ok(());
+                }
+                let t = trendline_param(p)?;
+                let eligible: Vec<usize> =
+                    targets.into_iter().filter(|i| gridcraft_chart::supports_trendline(gridcraft_chart::series_plot_kind(c, *i))).collect();
+                if eligible.is_empty() {
+                    return Err(bad("chart.addElement", "trendlines need a 2-D column, bar, line, area, scatter or bubble series"));
+                }
+                for i in eligible {
+                    if let Some(se) = c.series.get_mut(i) {
+                        se.trendlines.push(t.clone());
+                    }
+                }
+            }
             other => return Err(bad("chart.addElement", format!("unknown element `{other}`"))),
         }
         Ok(())
     })
 }
 
+/// The trendline described by `chart.addElement`'s trendline parameters (Excel's Add Chart
+/// Element ▸ Trendline choices, plus the Format Trendline options).
+fn trendline_param(p: &Json) -> Result<Trendline> {
+    let num = |k: &str| f64_param(p, k).filter(|v| v.is_finite() && *v >= 0.0).unwrap_or(0.0);
+    let mut t = Trendline {
+        forward: num("forward"),
+        backward: num("backward"),
+        display_equation: bool_param(p, "displayEquation").unwrap_or(false),
+        display_r_squared: bool_param(p, "displayRSquared").unwrap_or(false),
+        ..Trendline::default()
+    };
+    t.kind = match str_param(p, "type").unwrap_or("linear") {
+        "linear" => TrendlineKind::Linear,
+        // Excel's Linear Forecast: a linear trendline projected two periods ahead.
+        "linearForecast" => {
+            if t.forward == 0.0 {
+                t.forward = 2.0;
+            }
+            TrendlineKind::Linear
+        }
+        "exponential" => TrendlineKind::Exponential,
+        "logarithmic" => TrendlineKind::Logarithmic,
+        "power" => TrendlineKind::Power,
+        "polynomial" => TrendlineKind::Polynomial(u32_param(p, "order").unwrap_or(2).clamp(2, 6) as u8),
+        "movingAverage" => TrendlineKind::MovingAverage(u32_param(p, "period").unwrap_or(2).clamp(2, 255)),
+        other => return Err(bad("chart.addElement", format!("unknown trendline type `{other}`"))),
+    };
+    Ok(t)
+}
+
 fn quick_layout(s: &mut Session, p: &Json) -> Result<Json> {
     let n = u32_param(p, "layout").unwrap_or(1);
     with_chart(s, p, |c| {
@@ -421,6 +477,7 @@ fn select_data(s: &mut Session, p: &Json) -> Result<Json> {
     with_chart(s, p, move |c| {
         if let Some((series, source, by_rows)) = rebuilt {
             c.series = series;
+            super::insert::scatter_x_from_first(c.kind, &mut c.series);
             c.source = Some(source);
             c.by_rows = by_rows;
         }
@@ -644,6 +701,12 @@ fn stash_get(wb: &Workbook, key: &str) -> Json {
         .unwrap_or(json!({}))
 }
 
+/// Like `stash_get`, for the name-keyed lists (views, scripts): a stored value that is not a JSON object is treated as empty.
+fn stash_map(wb: &Workbook, key: &str) -> Json {
+    let v = stash_get(wb, key);
+    if v.is_object() { v } else { json!({}) }
+}
+
 fn stash_set(wb: &mut Workbook, key: &str, v: &Json) {
     let text = v.to_string();
     let formula = format!("\"{}\"", text.replace('"', "\"\""));
@@ -651,9 +714,22 @@ fn stash_set(wb: &mut Workbook, key: &str, v: &Json) {
     wb.names.push(DefinedName { name: key.into(), scope: None, formula, comment: String::new(), hidden: true });
 }
 
+/// The Watch Window list isn't an edit (Excel doesn't undo it): undo and redo keep the current
+/// list when they swap in another snapshot of the workbook.
+pub(crate) fn keep_watch_list(from: &Workbook, to: &mut std::sync::Arc<Workbook>) {
+    let find = |wb: &Workbook| wb.names.iter().find(|n| n.name == WATCH_NAME).cloned();
+    let keep = find(from);
+    if keep == find(to) {
+        return;
+    }
+    let wb = std::sync::Arc::make_mut(to);
+    wb.names.retain(|n| n.name != WATCH_NAME);
+    wb.names.extend(keep);
+}
+
 fn custom_views(s: &mut Session, p: &Json) -> Result<Json> {
     let d = s.doc()?;
-    let mut views = stash_get(&d.wb, VIEWS_NAME);
+    let mut views = stash_map(&d.wb, VIEWS_NAME);
     if let Some(name) = str_param(p, "save") {
         let sh = d.wb.active().ok_or(EngineError::NoDocument)?;
         views[name] = json!({"sheet": d.wb.active_sheet, "selection": d.selection.a1(), "zoom": sh.zoom, "freeze": sh.freeze});
@@ -673,6 +749,17 @@ fn custom_views(s: &mut Session, p: &Json) -> Result<Json> {
         if let Some(z) = v["zoom"].as_u64() {
             s.execute("view.zoom", json!({"percent": z}))?;
         }
+        if let Some(f) = v.get("freeze") {
+            let freeze = match (f[0].as_u64(), f[1].as_u64()) {
+                (Some(r), Some(c)) => u32::try_from(r).ok().zip(u32::try_from(c).ok()),
+                _ => None,
+            };
+            edit(s, |cx| {
+                let si = cx.sheet_index();
+                cx.sheet_mut(si)?.freeze = freeze;
+                Ok(())
+            })?;
+        }
     } else if let Some(name) = str_param(p, "delete") {
         if let Some(o) = views.as_object_mut() {
             o.remove(name);
@@ -742,7 +829,7 @@ fn table_resize(s: &mut Session, p: &Json) -> Result<Json> {
         let sheet = cx.sheet_mut(si)?;
         let headers: Vec<String> = (r.start.col..=r.end.col).map(|c| sheet.value(CellRef::new(r.start.row, c)).display()).collect();
         let t = sheet.tables.get_mut(ti).ok_or_else(|| bad("table", "gone"))?;
-        if r.start.row != t.range.start.row {
+        if r.start.row != t.range.start.row || !r.intersects(&t.range) {
             return Err(EngineError::Other(
                 "The headers must remain in the same row, and the resulting table range must overlap the original table range.".into(),
             ));
@@ -751,7 +838,14 @@ fn table_resize(s: &mut Session, p: &Json) -> Result<Json> {
         for (i, h) in headers.iter().enumerate() {
             let name = if h.is_empty() { format!("Column{}", i + 1) } else { h.clone() };
             let existing = t.columns.iter().find(|c| c.name.eq_ignore_ascii_case(&name)).cloned();
-            cols.push(existing.unwrap_or(TableColumn { name, totals: TotalsFn::None, totals_label: None, formula: None }));
+            cols.push(existing.unwrap_or(TableColumn {
+                name,
+                totals: TotalsFn::None,
+                totals_label: None,
+                formula: None,
+                unique_name: None,
+                xml: None,
+            }));
         }
         t.columns = cols;
         t.range = r;
@@ -868,7 +962,7 @@ fn new_script(s: &mut Session, p: &Json) -> Result<Json> {
         return Err(bad("automate.newScript", "`commands` must be an array"));
     }
     edit(s, |cx| {
-        let mut all = stash_get(&cx.wb, SCRIPTS_NAME);
+        let mut all = stash_map(&cx.wb, SCRIPTS_NAME);
         all[name.as_str()] = cmds.clone();
         stash_set(&mut cx.wb, SCRIPTS_NAME, &all);
         Ok(json!({"name": name}))
@@ -907,7 +1001,7 @@ fn run_script(s: &mut Session, p: &Json) -> Result<Json> {
 fn delete_script(s: &mut Session, p: &Json) -> Result<Json> {
     let name = str_param(p, "name").ok_or_else(|| bad("automate.deleteScript", "missing `name`"))?.to_string();
     edit(s, |cx| {
-        let mut all = stash_get(&cx.wb, SCRIPTS_NAME);
+        let mut all = stash_map(&cx.wb, SCRIPTS_NAME);
         if let Some(o) = all.as_object_mut() {
             o.remove(&name);
         }
@@ -982,8 +1076,13 @@ fn toggle_checkbox(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Copy of the params that is always a JSON object, so keys can be assigned; any other JSON value counts as no params (like null).
+fn object_params(p: &Json) -> Json {
+    Json::Object(p.as_object().cloned().unwrap_or_default())
+}
+
 fn theme_colors(s: &mut Session, p: &Json) -> Result<Json> {
-    let mut params = p.clone();
+    let mut params = object_params(p);
     if params.get("name").is_none() {
         params["name"] = json!(s.doc()?.wb.theme.name.clone());
     }
@@ -1004,7 +1103,7 @@ fn background(s: &mut Session, p: &Json) -> Result<Json> {
             Ok(Json::Null)
         });
     }
-    let mut params = p.clone();
+    let mut params = object_params(p);
     params["alt"] = json!("Sheet background");
     params["at"] = json!("A1");
     s.execute("insert.picture", params)
@@ -1020,7 +1119,7 @@ fn draw_border(s: &mut Session, p: &Json) -> Result<Json> {
         "outline" => "outside",
         _ => "all",
     };
-    let mut params = p.clone();
+    let mut params = object_params(p);
     params["preset"] = json!(preset);
     s.execute("home.borders", params)
 }

crates/engine/src/cmd/file.rs

@@ -8,7 +8,7 @@ use crate::DocState;
 pub fn specs() -> Vec<CommandSpec> {
     vec![
         cmd!(noundo "file.new", "New Workbook", ["File"], Some("Cmd+N"), "{sample?: \"budget\"|\"sales\"|\"grades\"}", always, new_workbook),
-        cmd!(noundo "file.open", "Open…", ["File"], Some("Cmd+O"), "{path} | {name, base64} (xlsx, xlsm, xls import, xlsb and ods data import, csv, tsv, txt, json)", always, open),
+        cmd!(noundo "file.open", "Open…", ["File"], Some("Cmd+O"), "{path} | {name, base64}, plus {password} for a password-protected workbook (xlsx, xlsm, xls import, xlsb and ods data import, csv, tsv, txt, json)", always, open),
         cmd!(noundo "file.save", "Save", ["File"], Some("Cmd+S"), "{path?} (xlsx by default; .csv/.tsv/.json/.html/.pdf by extension)", has_doc, save),
         cmd!(noundo "file.saveAs", "Save As…", ["File"], Some("Cmd+Shift+S"), "{path} (.xlsx, .csv, .tsv, .json, .html, or .pdf: a PDF of the active sheet)", has_doc, save_as),
         cmd!(query "file.saveBytes", "Encode Workbook", [], None, "{format?: xlsx|csv|tsv|json|html} → {base64}", has_doc, save_bytes),
@@ -55,7 +55,9 @@ fn open(s: &mut Session, p: &Json) -> Result<Json> {
         s.ui_requests.push(crate::UiRequest::Dialog("open".into(), json!({})));
         return ok();
     };
-    let (wb, warnings) = crate::io::open_bytes(&name, &bytes)?;
+    let encrypted = gridcraft_xlsx::sniff(&bytes) == gridcraft_xlsx::Format::Encrypted;
+    let (mut wb, warnings) = crate::io::open_bytes_with_password(&name, &bytes, str_param(p, "password"))?;
+    wb.source_dir = str_param(p, "path").and_then(crate::io::source_dir);
     let imported =
         matches!(crate::io::FileKind::from_path(&name), Some(crate::io::FileKind::Ods | crate::io::FileKind::Xlsb | crate::io::FileKind::Xls))
             || matches!(gridcraft_xlsx::sniff(&bytes), gridcraft_xlsx::Format::Ods | gridcraft_xlsx::Format::Xlsb | gridcraft_xlsx::Format::Xls);
@@ -64,19 +66,27 @@ fn open(s: &mut Session, p: &Json) -> Result<Json> {
     } else {
         std::path::Path::new(&name).file_name().and_then(|n| n.to_str()).unwrap_or("Book").to_string()
     };
-    // An import has no save target: ordinary Save must ask for a new destination.
-    let path = str_param(p, "path").filter(|_| !imported).map(str::to_string);
+    // An import has no save target: ordinary Save must ask for a new destination. Neither does a
+    // workbook decrypted with its password, so Save never replaces the encrypted original with
+    // an unprotected copy.
+    let path = str_param(p, "path").filter(|_| !imported && !encrypted).map(str::to_string);
     // Replace an untouched blank Book1 like Excel does.
     if s.documents().len() == 1
         && s.active().is_some_and(|d| d.path.is_none() && !d.is_dirty() && d.undo.is_empty() && d.wb.sheets.iter().all(|sh| sh.cells.is_empty()))
     {
         s.close_document(0);
     }
-    let i = s.add_document(DocState::new(wb, path, title));
-    if !warnings.is_empty() {
-        let mut message = warnings.iter().take(5).cloned().collect::<Vec<_>>().join("\n\n");
-        if warnings.len() > 5 {
-            message.push_str(&format!("\n\n{} additional import warnings.", warnings.len() - 5));
+    let mut doc = DocState::new(wb, path, title);
+    if crate::io::FileKind::from_path(&name).is_none() && gridcraft_xlsx::sniff(&bytes) == gridcraft_xlsx::Format::Xlsx {
+        doc.content_kind = Some(crate::io::FileKind::Xlsx);
+    }
+    let i = s.add_document(doc);
+    // The decrypted-workbook notice is for the info bar, not a message box.
+    let shown: Vec<&str> = warnings.iter().map(String::as_str).filter(|w| *w != crate::io::DECRYPTED_NOTICE).collect();
+    if !shown.is_empty() {
+        let mut message = shown.iter().take(5).copied().collect::<Vec<_>>().join("\n\n");
+        if shown.len() > 5 {
+            message.push_str(&format!("\n\n{} additional import warnings.", shown.len() - 5));
         }
         s.ui_requests.push(crate::UiRequest::Message(message));
     }
@@ -100,11 +110,18 @@ fn save(s: &mut Session, p: &Json) -> Result<Json> {
         return super::print::export_pdf(s, &json!({"path": path}));
     }
     let d = s.doc_mut()?;
-    let bytes = crate::io::save_bytes(&d.wb, &path)?;
+    // The document's own file keeps the format its content had when opened; any other path
+    // goes by its extension. Relative paths to linked workbooks are rewritten for the new folder.
+    let kind = crate::io::FileKind::from_path(&path).or(d.content_kind.filter(|_| d.path.as_deref() == Some(path.as_str())));
+    let rebased = crate::io::source_dir(&path).and_then(|f| gridcraft_xlsx::rebase_links(&d.wb, &f));
+    let wb = rebased.as_ref().unwrap_or(&d.wb);
+    let bytes = match kind {
+        Some(kind) => crate::io::save_bytes_as(wb, &path, kind)?,
+        None => crate::io::save_bytes(wb, &path)?,
+    };
     crate::io::write_file(&path, &bytes)?;
-    let kind = crate::io::FileKind::from_path(&path).unwrap_or(crate::io::FileKind::Xlsx);
     // Only a full-fidelity format clears the dirty flag and becomes the document's file.
-    if matches!(kind, crate::io::FileKind::Xlsx | crate::io::FileKind::Json) {
+    if matches!(kind, Some(crate::io::FileKind::Xlsx | crate::io::FileKind::Json)) {
         d.saved = d.wb.clone();
         d.path = Some(path.clone());
     }

crates/engine/src/cmd/forecast.rs

@@ -42,7 +42,7 @@ pub fn specs() -> Vec<CommandSpec> {
         "Forecast Sheet",
         ["Data", "Forecast"],
         None,
-        "{timeline?: \"A2:A25\", values?: \"B2:B25\" (default: the first two columns of `range`, the selection or the current region; a text first cell is the header), end?: timeline value or date text | periods?: n (default: a third of the history, at least 1; ≤10,000 and history × periods ≤ 500,000; history ≤ 10,000 rows), confidenceInterval?: bool (default true), confidence?: 0.95 or 95, seasonality?: \"auto\" | 0 (none) | 2–8,760, fillMissing?: interpolate|zeros, aggregate?: average|count|counta|max|median|min|sum, statistics?: bool, chart?: line|column} → {sheet, table, chart, history, periods}. Inserts a sheet before the active one: timeline, values, Forecast (FORECAST.ETS), Lower/Upper Confidence Bound (FORECAST.ETS.CONFINT), optional FORECAST.ETS.STAT table, and a chart.",
+        "{timeline?: \"A2:A25\", values?: \"B2:B25\" (default: the first two columns of `range`, the selection or the current region; a text first cell is the header), end?: timeline value or date text | periods?: n (default: a third of the history, at least 1; ≤10,000 and history × periods ≤ 500,000; history ≤ 10,000 rows), forecastStart?: a timeline value or date text on the history, before its last point (hindcast: the model is fit to the points before it, the forecast columns start there and run over the actuals; default and the last point: forecast after the history), confidenceInterval?: bool (default true), confidence?: 0.95 or 95, seasonality?: \"auto\" | 0 (none) | 2–8,760, fillMissing?: interpolate|zeros, aggregate?: average|count|counta|max|median|min|sum, statistics?: bool, chart?: line|column} → {sheet, table, chart, history, periods}. Inserts a sheet before the active one: timeline, values, Forecast (FORECAST.ETS), Lower/Upper Confidence Bound (FORECAST.ETS.CONFINT), optional FORECAST.ETS.STAT table, and a chart.",
         has_doc,
         forecast_sheet
     )]
@@ -223,13 +223,39 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
     if !rows.iter().any(|r| matches!(r.1, Value::Number(_))) {
         return Err(EngineError::Other("There are no values to forecast.".into()));
     }
-    let end = match p.get("end") {
-        Some(Json::Number(n)) => n.as_f64(),
-        Some(Json::String(t)) if !t.trim().is_empty() => match gridcraft_core::parse::parse_input(t.trim(), sys).value {
-            Value::Number(end) => Some(end),
-            _ => return Err(bad(CMD, format!("`end` is not a number or a date: `{t}`"))),
-        },
-        _ => None,
+    let time_param = |key: &str| -> Result<Option<f64>> {
+        match p.get(key) {
+            Some(Json::Number(n)) => Ok(n.as_f64()),
+            Some(Json::String(t)) if !t.trim().is_empty() => match gridcraft_core::parse::parse_input(t.trim(), sys).value {
+                Value::Number(x) => Ok(Some(x)),
+                _ => Err(bad(CMD, format!("`{key}` is not a number or a date: `{t}`"))),
+            },
+            None | Some(Json::Null) => Ok(None),
+            Some(Json::String(_)) => Ok(None),
+            Some(_) => Err(bad(CMD, format!("`{key}` is not a number or a date"))),
+        }
+    };
+    let end = time_param("end")?;
+    // Forecast Start: the index (into `rows`) of the first forecast point, or `rows.len()` for the
+    // usual forecast after the history.
+    let fit = match time_param("forecastStart")? {
+        None => rows.len(),
+        Some(start) => {
+            let last_t = times.last().copied().unwrap_or(f64::NAN);
+            let tol = |a: f64, b: f64| (a - b).abs() <= 1e-9 * a.abs().max(b.abs()).max(1.0);
+            if tol(start, last_t) || timeline.after_last(1).is_some_and(|next| tol(start, next)) {
+                rows.len()
+            } else {
+                let i = times
+                    .iter()
+                    .position(|t| tol(*t, start))
+                    .ok_or_else(|| bad(CMD, "`forecastStart` is not on the timeline (it is a point of the history, before its last point)"))?;
+                if rows.get(..i).is_none_or(|h| h.iter().filter(|r| matches!(r.1, Value::Number(_))).count() < 2) {
+                    return Err(EngineError::Other("The forecast start needs at least two values before it to fit the forecast.".into()));
+                }
+                i
+            }
+        }
     };
     let cap = max_periods(rows.len());
     let periods = match end {
@@ -252,8 +278,9 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
     // Columns: A timeline, B values, C forecast, D/E bounds.
     let n = rows.len() as u32;
     let last = n + 1; // 1-based row of the last history point
+    let fit_last = fit as u32 + 1; // 1-based row of the last point the model is fit to
     let end_row = last + periods; // 1-based row of the last forecast
-    let hist = |col: u32| format!("${0}$2:${0}${last}", col_letters(col));
+    let hist = |col: u32| format!("${0}$2:${0}${fit_last}", col_letters(col));
     let mut tail = format!("{},{}", opts.seasonality, opts.fill);
     if let Some(a) = opts.aggregate {
         tail.push_str(&format!(",{a}"));
@@ -305,22 +332,30 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
                 put(&mut sheet, r, 1, v.clone(), vstyle);
             }
         }
-        // The last history point starts the forecast lines, so they join the values.
-        formula(&mut sheet, n, 2, format!("=B{last}"), vstyle);
+        // The last point the model is fit to starts the forecast lines, so they join the values.
+        let join = fit_last - 1; // 0-based row
+        formula(&mut sheet, join, 2, format!("=B{fit_last}"), vstyle);
         if opts.confidence.is_some() {
-            formula(&mut sheet, n, 3, format!("=C{last}"), vstyle);
-            formula(&mut sheet, n, 4, format!("=C{last}"), vstyle);
+            formula(&mut sheet, join, 3, format!("=C{fit_last}"), vstyle);
+            formula(&mut sheet, join, 4, format!("=C{fit_last}"), vstyle);
         }
         let (tl, vl) = (hist(0), hist(1));
+        let forecast_row = |sheet: &mut Sheet, r: u32| {
+            formula(sheet, r - 1, 2, format!("=FORECAST.ETS(A{r},{vl},{tl},{tail})"), vstyle);
+            if let Some(c) = opts.confidence {
+                let ci = format!("FORECAST.ETS.CONFINT(A{r},{vl},{tl},{c},{tail})");
+                formula(sheet, r - 1, 3, format!("=C{r}-{ci}"), vstyle);
+                formula(sheet, r - 1, 4, format!("=C{r}+{ci}"), vstyle);
+            }
+        };
+        // Hindcast: forecasts over the actuals from the start to the last history point.
+        for r in (fit_last + 1)..=last {
+            forecast_row(&mut sheet, r);
+        }
         for (k, t) in future.iter().enumerate() {
             let r = last + k as u32 + 1; // 1-based
             put(&mut sheet, r - 1, 0, Value::Number(*t), tstyle);
-            formula(&mut sheet, r - 1, 2, format!("=FORECAST.ETS(A{r},{vl},{tl},{tail})"), vstyle);
-            if let Some(c) = opts.confidence {
-                let ci = format!("FORECAST.ETS.CONFINT(A{r},{vl},{tl},{c},{tail})");
-                formula(&mut sheet, r - 1, 3, format!("=C{r}-{ci}"), vstyle);
-                formula(&mut sheet, r - 1, 4, format!("=C{r}+{ci}"), vstyle);
-            }
+            forecast_row(&mut sheet, r);
         }
         if opts.statistics {
             put(&mut sheet, 0, stats_col, Value::text("Statistic"), bold);
@@ -351,13 +386,19 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
             range,
             header_row: true,
             totals_row: false,
-            columns: headers.iter().map(|h| TableColumn { name: h.clone(), totals: TotalsFn::None, totals_label: None, formula: None }).collect(),
+            columns: headers
+                .iter()
+                .map(|h| TableColumn { name: h.clone(), totals: TotalsFn::None, totals_label: None, formula: None, unique_name: None, xml: None })
+                .collect(),
             style: "TableStyleMedium2".into(),
             banded_rows: true,
             banded_cols: false,
             first_col: false,
             last_col: false,
             filter_button: true,
+            filter: vec![],
+            table_type: None,
+            connection_id: None,
         });
         let q = gridcraft_formula::quote_sheet(&sheet_name);
         let col_ref = |c: u32| format!("{q}!${0}$2:${0}${end_row}", col_letters(c));
@@ -371,6 +412,7 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
                 secondary: false,
                 kind: (opts.column_chart && c >= 3).then_some(ChartKind::Line),
                 smooth: false,
+                trendlines: Vec::new(),
             })
             .collect();
         sheet.charts.push(Chart {
@@ -405,7 +447,7 @@ fn forecast_sheet(s: &mut Session, p: &Json) -> Result<Json> {
     if let Ok(d) = s.doc_mut() {
         d.sheet_selections.insert(index.min(d.sheet_selections.len()), crate::Selection::default());
     }
-    Ok(json!({"sheet": sheet_name, "table": table_name, "chart": chart_id, "history": n, "periods": periods}))
+    Ok(json!({"sheet": sheet_name, "table": table_name, "chart": chart_id, "history": n, "periods": periods, "fitted": fit}))
 }
 
 /// Forecast rows needed to reach `end` (rounded up to whole steps).
@@ -543,4 +585,39 @@ mod tests {
         s.execute("cell.set", json!({"cell": "A5", "input": "4.5"})).unwrap();
         assert!(s.execute("data.forecastSheet", json!({"range": "Sheet1!A1:B17"})).is_err());
     }
+
+    #[test]
+    fn forecast_start_hindcasts_over_the_actuals() {
+        let mut s = session_with_history(); // t = 1..16 in A2:A17
+        let r = s.execute("data.forecastSheet", json!({"range": "A1:B17", "forecastStart": 13, "periods": 2, "confidenceInterval": false})).unwrap();
+        assert_eq!(r["fitted"], 12);
+        // Fit to t = 1..12 (rows 2..13); the line joins at row 13 and forecasts rows 14..19.
+        assert_eq!(formula(&s, 0, "C13"), "B13");
+        assert_eq!(value(&s, 0, "C13"), value(&s, 0, "B13"));
+        assert_eq!(formula(&s, 0, "C14"), "FORECAST.ETS(A14,$B$2:$B$13,$A$2:$A$13,1,1)");
+        assert_eq!(formula(&s, 0, "C19"), "FORECAST.ETS(A19,$B$2:$B$13,$A$2:$A$13,1,1)");
+        // The exact seasonal series is recovered, and the actual is still shown next to it.
+        let c14 = value(&s, 0, "C14").as_f64().unwrap();
+        assert!((c14 - 39.0).abs() < 1e-6, "{c14}"); // t = 13: 10 + 26 + 3
+        assert!(value(&s, 0, "B14").as_f64().is_some());
+        // Start at the last point or one step later: as without forecastStart.
+        for start in [json!(16), json!(17)] {
+            let r = s.execute("data.forecastSheet", json!({"range": "Sheet1!A1:B17", "forecastStart": start, "periods": 2})).unwrap();
+            assert_eq!(r["fitted"], 16);
+        }
+        assert_eq!(formula(&s, 0, "C18"), "FORECAST.ETS(A18,$B$2:$B$17,$A$2:$A$17,1,1)");
+    }
+
+    #[test]
+    fn forecast_start_invalid_values_are_errors() {
+        let mut s = session_with_history();
+        let sheets = s.doc().unwrap().wb.sheets.len();
+        for bad in [json!(0), json!(2), json!(3.5), json!(18), json!(1000), json!("abc"), json!([1]), json!(1e308)] {
+            assert!(s.execute("data.forecastSheet", json!({"range": "A1:B17", "forecastStart": bad})).is_err(), "{bad}");
+        }
+        assert_eq!(s.doc().unwrap().wb.sheets.len(), sheets);
+        // Blank or null behaves like no start; empty params unchanged.
+        let r = s.execute("data.forecastSheet", json!({"range": "A1:B17", "forecastStart": ""})).unwrap();
+        assert_eq!(r["fitted"], 16);
+    }
 }

crates/engine/src/cmd/format.rs

@@ -237,10 +237,12 @@ pub(crate) fn apply_style(s: &mut Session, p: &Json, f: impl Fn(&mut Style)) ->
                 // Existing cells in those lines.
                 let cells: Vec<(CellRef, StyleId)> =
                     cx.wb.sheet(sheet).map(|sh| sh.cells.iter_range(*r).map(|(c, x)| (c, x.style)).collect()).unwrap_or_default();
-                for (c, st) in cells {
-                    let new = *cache.entry(st).or_insert_with(|| cx.wb.styles.derive(st, &f));
-                    cx.sheet_mut(sheet)?.set_style(c, new);
+                for (c, st) in &cells {
+                    let new = *cache.entry(*st).or_insert_with(|| cx.wb.styles.derive(*st, &f));
+                    cx.sheet_mut(sheet)?.set_style(*c, new);
                 }
+                // Formatting touched these cells: re-fit their rows (Excel auto-fits).
+                cx.fit_rows.extend(cells.iter().map(|(c, _)| (sheet, c.row)));
                 continue;
             }
             if r.count() > 4_000_000 {
@@ -561,8 +563,11 @@ fn merge(s: &mut Session, p: &Json, how: &str) -> Result<Json> {
         if how == "center" && s.doc()?.wb.sheet(sheet).is_some_and(|sh| ranges.iter().all(|r| sh.merges.contains(r))) { "unmerge" } else { how };
     edit(s, |cx| {
         let mut touched = Vec::new();
+        // Areas whose merging changes: a merged cell blocks a dynamic array's spill.
+        let mut areas: Vec<RangeRef> = ranges.clone();
         for r in &ranges {
             let sh = cx.sheet_mut(sheet)?;
+            areas.extend(sh.merges.iter().filter(|m| m.intersects(r)));
             sh.merges.retain(|m| !m.intersects(r));
             match how {
                 "unmerge" => {}
@@ -571,6 +576,16 @@ fn merge(s: &mut Session, p: &Json, how: &str) -> Result<Json> {
                         let m = RangeRef::new(CellRef::new(row, r.start.col), CellRef::new(row, r.end.col));
                         if !m.is_single() {
                             sh.merges.push(m);
+                            // As below: only the first value of each row survives.
+                            let others: Vec<CellRef> = sh.cells.iter_range(m).map(|(c, _)| c).filter(|c| *c != m.start).collect();
+                            for c in others {
+                                if let Some(mut cell) = sh.cells.get(c).cloned() {
+                                    cell.value = gridcraft_core::Value::Empty;
+                                    cell.formula = None;
+                                    sh.set_cell(c, cell);
+                                }
+                                touched.push((sheet, c));
+                            }
                         }
                     }
                 }
@@ -593,6 +608,17 @@ fn merge(s: &mut Session, p: &Json, how: &str) -> Result<Json> {
                 }
             }
         }
+        // Spills over the areas, and blocked ones that could reach them, are evaluated again.
+        let sh = cx.sheet_mut(sheet)?;
+        for a in &areas {
+            touched.extend(sh.spill_ranges.iter().filter(|(_, r)| r.intersects(a)).map(|(anchor, _)| (sheet, *anchor)));
+            let reach = RangeRef::new(CellRef::new(0, 0), a.end);
+            let blocked = sh
+                .cells
+                .iter_range(reach)
+                .filter(|(_, x)| x.formula.is_some() && x.value == gridcraft_core::Value::Error(gridcraft_core::CellError::Spill));
+            touched.extend(blocked.map(|(c, _)| (sheet, c)));
+        }
         cx.changed.extend(touched);
         Ok(())
     })?;
@@ -939,6 +965,7 @@ fn row_height(s: &mut Session, p: &Json) -> Result<Json> {
                 e.custom = true;
             }
         }
+        cx.structural = true; // setting a height shows or hides rows: SUBTOTAL(10x) depends on it
         Ok(Json::Null)
     })
 }
@@ -978,9 +1005,7 @@ pub fn chars_to_points(c: f64) -> f64 {
     }
 }
 
-pub fn points_to_chars(px: f64) -> f64 {
-    if px <= 12.0 { (px / 12.0 * 100.0).round() / 100.0 } else { ((px - 5.0) / 7.0 * 100.0 + 0.5).trunc() / 100.0 }
-}
+pub use gridcraft_model::points_to_chars;
 
 /// Approximate text width in points for autofit (no font metrics in the engine: average glyph
 /// widths for the default font; the UI refines with real measurement when it autofits).
@@ -1019,7 +1044,9 @@ fn autofit_cols(s: &mut Session, p: &Json) -> Result<Json> {
                     let st = cx.wb.styles.get(sh.style_id(cell));
                     let text = crate::display::cell_text(&cx.wb, sh, cell);
                     for line in text.lines() {
-                        max = max.max(approx_text_width(line, st.font.size, st.font.bold) + 6.0 + st.align.indent as f32 * 9.0);
+                        max = max.max(
+                            approx_text_width(line, st.font.size, st.font.bold) + 6.0 + st.align.indent as f32 * 9.0 + sh.filter_button_space(cell),
+                        );
                     }
                 }
                 if max > 0.0 {
@@ -1053,6 +1080,7 @@ fn autofit_rows(s: &mut Session, p: &Json) -> Result<Json> {
             }
             cx.fit_rows.extend((a..=b).map(|r| (si, r)));
         }
+        cx.structural = true; // autofit reveals hidden rows: SUBTOTAL(10x) depends on it
         Ok(Json::Null)
     })
 }
@@ -1096,6 +1124,19 @@ fn hide(s: &mut Session, p: &Json, rows: bool, on: bool) -> Result<Json> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn merge_across_keeps_the_first_value_of_each_row() {
+        let mut s = crate::Session::new();
+        s.new_workbook();
+        s.execute("range.setValues", json!({"range": "A1", "values": [[1, 2], [3, 4]]})).unwrap();
+        s.execute("cell.set", json!({"cell": "D1", "input": "=SUM(A1:B2)"})).unwrap();
+        s.execute("home.mergeAcross", json!({"range": "A1:B2"})).unwrap();
+        let v = |s: &mut crate::Session, a: &str| s.execute("cell.get", json!({"cell": a})).unwrap()["value"].clone();
+        assert_eq!(v(&mut s, "B1"), Json::Null);
+        assert_eq!(v(&mut s, "B2"), Json::Null);
+        assert_eq!(v(&mut s, "D1"), json!(4.0));
+    }
+
     #[test]
     fn decimal_steps() {
         let v = gridcraft_core::Value::Number(1.5);

crates/engine/src/cmd/formulas.rs

@@ -61,7 +61,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Calculation Options",
             ["Formulas", "Calculation"],
             None,
-            "{mode: automatic|automaticExceptTables|manual, iterative?, maxIterations?, maxChange?}",
+            "{mode?: automatic|automaticExceptTables|manual, iterative?: bool (Enable iterative calculation), maxIterations?: 1–32767 (100), maxChange?: number (0.001)} → the settings. File › Options › Formulas › Calculation options; stored in the workbook.",
             has_doc,
             calc_options
         ),
@@ -78,18 +78,28 @@ fn auto_sum(s: &mut Session, p: &Json) -> Result<Json> {
     };
     if !sel.is_single() {
         // A block: totals below each column (and to the right when a blank column is included).
-        let num_end = sel.end;
-        let below = CellRef::new(num_end.row + 1, 0);
-        let mut writes = Vec::new();
-        let last_row_blank = (sel.start.col..=sel.end.col).all(|c| sh.value(CellRef::new(sel.end.row, c)).is_empty());
-        let (data_end_row, out_row) = if last_row_blank { (sel.end.row.saturating_sub(1), sel.end.row) } else { (sel.end.row, below.row) };
-        for c in sel.start.col..=sel.end.col {
-            let r = RangeRef::new(CellRef::new(sel.start.row, c), CellRef::new(data_end_row, c));
-            writes.push((CellRef::new(out_row, c), format!("={func}({})", r.a1())));
-        }
-        for (c, f) in writes {
-            s.execute("cell.set", json!({"cell": c.a1(), "input": f}))?;
+        // Columns past the sheet's data get no total (a whole-row selection doesn't write 16,384
+        // formulas), and all totals are one edit (one undo step).
+        let Some(last_col) = sh.cells.used_range().map(|u| u.end.col.min(sel.end.col)) else { return ok() };
+        let last_row_blank = (sel.start.col..=last_col).all(|c| sh.value(CellRef::new(sel.end.row, c)).is_empty());
+        let (data_end_row, out_row) = if last_row_blank { (sel.end.row.saturating_sub(1), sel.end.row) } else { (sel.end.row, sel.end.row + 1) };
+        if out_row >= gridcraft_core::MAX_ROWS {
+            return Err(EngineError::Other("There's no room below the selection for the totals.".into()));
         }
+        let writes: Vec<(CellRef, String)> = (sel.start.col..=last_col)
+            .map(|c| {
+                (CellRef::new(out_row, c), format!("={func}({})", RangeRef::new(CellRef::new(sel.start.row, c), CellRef::new(data_end_row, c)).a1()))
+            })
+            .collect();
+        let sheet = d.wb.active_sheet;
+        edit(s, |cx| {
+            for (c, f) in &writes {
+                let cell = super::edit::input_to_cell(f, sheet, *c, &mut cx.wb)?.unwrap_or_default();
+                cx.sheet_mut(sheet)?.set_cell(*c, cell);
+                cx.touch(sheet, *c);
+            }
+            Ok(())
+        })?;
         return ok();
     }
     // Single cell: guess the range above, else to the left.
@@ -554,6 +564,7 @@ fn calc_options(s: &mut Session, p: &Json) -> Result<Json> {
         _ => None,
     };
     edit(s, |cx| {
+        let before = cx.wb.calc.clone();
         if let Some(m) = mode {
             cx.wb.calc.mode = m;
         }
@@ -561,15 +572,19 @@ fn calc_options(s: &mut Session, p: &Json) -> Result<Json> {
             cx.wb.calc.iterative = v;
         }
         if let Some(v) = u32_param(p, "maxIterations") {
-            cx.wb.calc.max_iterations = v.clamp(1, 32767);
+            cx.wb.calc.set_max_iterations(v);
         }
         if let Some(v) = f64_param(p, "maxChange") {
-            cx.wb.calc.max_change = v.abs();
+            cx.wb.calc.set_max_change(v);
         }
-        if mode == Some(CalcMode::Automatic) {
+        let c = &cx.wb.calc;
+        // Switching to automatic, or changing how circular references are calculated outside
+        // manual mode, recalculates the workbook.
+        let iteration_changed = (c.iterative, c.max_iterations, c.max_change) != (before.iterative, before.max_iterations, before.max_change);
+        if mode == Some(CalcMode::Automatic) || (iteration_changed && c.mode != CalcMode::Manual) {
             cx.structural = true;
         }
-        Ok(json!({"mode": format!("{:?}", cx.wb.calc.mode)}))
+        Ok(json!({"mode": format!("{:?}", c.mode), "iterative": c.iterative, "maxIterations": c.max_iterations, "maxChange": c.max_change}))
     })
 }
 

crates/engine/src/cmd/insert.rs

@@ -1,7 +1,7 @@
 //! Insert tab: tables, charts, sparklines, pictures, shapes, hyperlinks, comments and notes,
 //! conditional formatting (Home › Styles) and symbols.
 
-use gridcraft_core::{CellRef, RangeRef};
+use gridcraft_core::{CellRef, MAX_ROWS, RangeRef};
 use gridcraft_model::*;
 use serde_json::{Value as Json, json};
 
@@ -153,10 +153,19 @@ pub fn specs() -> Vec<CommandSpec> {
             "Link",
             ["Insert", "Links"],
             Some("Cmd+K"),
-            "{cell?, target: \"https://…\" | \"Sheet2!A1\" | \"mailto:…\", text?, tooltip?, remove?: bool}",
+            "{cell?, target: \"https://…\" | \"Book.xlsx\" | \"Sheet2!A1\" | \"mailto:…\", text?, tooltip?, remove?: bool}",
             has_doc,
             insert_link
         ),
+        cmd!(
+            "link.open",
+            "Open Hyperlink",
+            [],
+            None,
+            "{url?: \"https://…\" | \"mailto:…\" | \"Sheet2!A1\", cell?} (default: the cell's link); only http, https and mailto are opened, any other scheme is an error; the UI asks before opening",
+            has_doc,
+            open_link
+        ),
         cmd!("review.newNote", "New Note", ["Review", "Notes"], Some("Shift+F2"), "{cell?, text, author?}", has_doc, |s, p| comment(s, p, false)),
         cmd!("review.newComment", "New Comment", ["Review", "Comments"], Some("Cmd+Shift+F2"), "{cell?, text, author?}", has_doc, |s, p| comment(
             s, p, true
@@ -224,6 +233,12 @@ fn insert_table(s: &mut Session, p: &Json) -> Result<Json> {
     if d.wb.sheet(sheet).is_some_and(|sh| sh.tables.iter().any(|t| t.range.intersects(&r))) {
         return Err(EngineError::Other("A table can't overlap another table.".into()));
     }
+    let arrays = |sh: &gridcraft_model::Sheet| {
+        sh.cells.iter().any(|(_, x)| x.formula.as_ref().and_then(|f| f.array).is_some_and(|a| !a.is_single() && a.intersects(&r)))
+    };
+    if d.wb.sheet(sheet).is_some_and(arrays) {
+        return Err(EngineError::Other("Multi-cell array formulas aren't allowed in tables.".into()));
+    }
     if r.count() > 50_000_000 {
         return Err(bad("insert.table", "range too large"));
     }
@@ -234,9 +249,19 @@ fn insert_table(s: &mut Session, p: &Json) -> Result<Json> {
     let name = str_param(p, "name")
         .map(str::to_string)
         .unwrap_or_else(|| (1..).map(|n| format!("Table{n}")).find(|n| d.wb.table(n).is_none()).unwrap_or_else(|| "Table".into()));
+    if !valid_table_name(&name) {
+        return Err(EngineError::Other("The name that you entered is not valid.".into()));
+    }
     if d.wb.table(&name).is_some() || d.wb.names.iter().any(|n| n.name.eq_ignore_ascii_case(&name)) {
         return Err(EngineError::Other("The name entered already exists. Enter a unique name.".into()));
     }
+    // Without a header row, the data moves down a row to make room for one: never a table with it.
+    let moves_a_table = |sh: &gridcraft_model::Sheet| {
+        sh.tables.iter().any(|t| t.range.end.row >= r.start.row && t.range.start.col <= r.end.col && t.range.end.col >= r.start.col)
+    };
+    if !header && d.wb.sheet(sheet).is_some_and(moves_a_table) {
+        return Err(EngineError::Other("This operation isn't allowed: it would shift cells in a table on your worksheet.".into()));
+    }
     let style = str_param(p, "style").unwrap_or("TableStyleMedium2").to_string();
     let id = d.wb.next_object_id();
     edit(s, |cx| {
@@ -245,6 +270,11 @@ fn insert_table(s: &mut Session, p: &Json) -> Result<Json> {
             r
         } else {
             let sh = cx.sheet_mut(sheet)?;
+            // The header row pushes the data down one row: never off the end of the sheet.
+            let last = RangeRef::new(CellRef::new(MAX_ROWS - 1, r.start.col), CellRef::new(MAX_ROWS - 1, r.end.col));
+            if sh.cells.iter_range(last).any(|(_, x)| x.formula.is_some() || !x.value.is_empty()) {
+                return Err(EngineError::Other("To prevent possible loss of data, cells can't be pushed off the end of the worksheet.".into()));
+            }
             sh.cells.shift_rows_in_cols(r.start.col, r.end.col, r.start.row, 1);
             sh.cell_pictures = std::mem::take(&mut sh.cell_pictures)
                 .into_iter()
@@ -257,7 +287,7 @@ fn insert_table(s: &mut Session, p: &Json) -> Result<Json> {
                 sh.set_value(CellRef::new(r.start.row, c), gridcraft_core::Value::text(format!("Column{}", i + 1)));
             }
             cx.structural = true;
-            RangeRef::new(r.start, CellRef::new(r.end.row + 1, r.end.col))
+            RangeRef::new(r.start, CellRef::new((r.end.row + 1).min(MAX_ROWS - 1), r.end.col))
         };
         let sh = cx.sheet_mut(sheet)?;
         let mut names: Vec<String> = Vec::new();
@@ -289,13 +319,19 @@ fn insert_table(s: &mut Session, p: &Json) -> Result<Json> {
             range: r,
             header_row: true,
             totals_row: false,
-            columns: names.into_iter().map(|n| TableColumn { name: n, totals: TotalsFn::None, totals_label: None, formula: None }).collect(),
+            columns: names
+                .into_iter()
+                .map(|n| TableColumn { name: n, totals: TotalsFn::None, totals_label: None, formula: None, unique_name: None, xml: None })
+                .collect(),
             style,
             banded_rows: true,
             banded_cols: false,
             first_col: false,
             last_col: false,
             filter_button: true,
+            filter: vec![],
+            table_type: None,
+            connection_id: None,
         });
         cx.structural = true;
         Ok(json!({"table": name, "range": r.a1()}))
@@ -327,6 +363,9 @@ fn table_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
             "totals" => {
                 let v = on.unwrap_or(!t.totals_row);
                 if v != t.totals_row {
+                    if v && t.range.end.row.saturating_add(1) >= MAX_ROWS {
+                        return Err(EngineError::Other("There's no room below the table for the total row.".into()));
+                    }
                     t.totals_row = v;
                     if v {
                         t.range.end.row += 1;
@@ -355,7 +394,12 @@ fn table_flag(s: &mut Session, p: &Json, which: &str) -> Result<Json> {
             "bandedCols" => t.banded_cols = on.unwrap_or(!t.banded_cols),
             "firstCol" => t.first_col = on.unwrap_or(!t.first_col),
             "lastCol" => t.last_col = on.unwrap_or(!t.last_col),
-            "header" => t.filter_button = on.unwrap_or(!t.filter_button),
+            "header" => {
+                t.filter_button = on.unwrap_or(!t.filter_button);
+                if !t.filter_button {
+                    t.filter.clear();
+                }
+            }
             _ => {}
         }
         Ok(Json::Null)
@@ -421,14 +465,19 @@ fn table_style(s: &mut Session, p: &Json) -> Result<Json> {
     })
 }
 
+/// Table names follow the Microsoft name rules, as the xlsx writer does: letters, digits, `_` and `.`,
+/// starting with a letter, `_` or `\`. Anything else (a hyphen, say) would read as an operator inside a
+/// structured reference, and the writer would rename the table on save.
+fn valid_table_name(name: &str) -> bool {
+    name.starts_with(|c: char| c.is_alphabetic() || c == '_' || c == '\\')
+        && CellRef::parse(name).is_none()
+        && name.chars().enumerate().all(|(i, c)| c.is_alphanumeric() || c == '_' || c == '.' || (i == 0 && c == '\\'))
+}
+
 fn table_rename(s: &mut Session, p: &Json) -> Result<Json> {
     let (si, ti) = find_table(s, p)?;
     let name = str_param(p, "name").ok_or_else(|| bad("table.rename", "missing `name`"))?.to_string();
-    if name.is_empty()
-        || name.contains(' ')
-        || name.chars().next().is_some_and(|c| c.is_ascii_digit())
-        || gridcraft_core::CellRef::parse(&name).is_some()
-    {
+    if !valid_table_name(&name) {
         return Err(EngineError::Other("The name that you entered is not valid.".into()));
     }
     if s.doc()?.wb.table(&name).is_some_and(|x| x != (si, ti)) {
@@ -443,6 +492,8 @@ fn table_rename(s: &mut Session, p: &Json) -> Result<Json> {
         for i in 0..cx.wb.sheets.len() {
             let keys: Vec<(CellRef, std::sync::Arc<Formula>)> =
                 cx.wb.sheets.get(i).map(|s| s.cells.iter().filter_map(|(c, x)| x.formula.clone().map(|f| (c, f))).collect()).unwrap_or_default();
+            // A bare name that is also a defined name resolves to the defined name, so it is not the table.
+            let shadowed = cx.wb.name(&old, i).is_some();
             let Some(sh) = cx.wb.sheet_mut(i) else { continue };
             for (c, f) in keys {
                 let Some(e) = f.expr() else { continue };
@@ -451,7 +502,7 @@ fn table_rename(s: &mut Session, p: &Json) -> Result<Json> {
                         st.table = name.clone();
                         gridcraft_formula::Expr::Struct(st)
                     }
-                    gridcraft_formula::Expr::Name(n) if n.eq_ignore_ascii_case(&old) => gridcraft_formula::Expr::Name(name.clone()),
+                    gridcraft_formula::Expr::Name(n) if !shadowed && n.eq_ignore_ascii_case(&old) => gridcraft_formula::Expr::Name(name.clone()),
                     o => o,
                 });
                 if let Some(cell) = sh.cells.get_mut(c) {
@@ -553,6 +604,7 @@ pub fn series_from_range(sh: &Sheet, r: RangeRef, by_rows: bool) -> Vec<Series>
                 secondary: false,
                 kind: None,
                 smooth: false,
+                trendlines: Vec::new(),
             });
         }
     } else {
@@ -567,12 +619,24 @@ pub fn series_from_range(sh: &Sheet, r: RangeRef, by_rows: bool) -> Vec<Series>
                 secondary: false,
                 kind: None,
                 smooth: false,
+                trendlines: Vec::new(),
             });
         }
     }
     out
 }
 
+/// A scatter plot of a block without category labels takes its first column (or row) as the X
+/// values of the others, as Excel does: two plain columns make one series of points, not two (#428).
+pub fn scatter_x_from_first(kind: ChartKind, series: &mut Vec<Series>) {
+    if matches!(kind, ChartKind::Scatter | ChartKind::ScatterLines) && series.len() > 1 && series[0].categories.is_none() {
+        let x = series.remove(0).values;
+        for se in series.iter_mut() {
+            se.categories = Some(x.clone());
+        }
+    }
+}
+
 /// Most cells a chart's source block may span (bounds the series it builds).
 const MAX_CHART_CELLS: u64 = 1_000_000;
 
@@ -661,10 +725,11 @@ pub fn build_chart(s: &Session, p: &Json) -> Result<(usize, Chart)> {
     let data_w = r.width();
     let by_rows = data_w > data_h + 1;
     let kind = chart_kind(&t, &sub);
-    let series = series_from_range(sh, r, by_rows);
+    let mut series = series_from_range(sh, r, by_rows);
     if series.is_empty() {
         return Err(EngineError::Other("Select data for the chart first.".into()));
     }
+    scatter_x_from_first(kind, &mut series);
     let id = d.wb.next_object_id();
     let at = cell_param_on(s, p, "at", sheet)?.unwrap_or_else(|| CellRef::new(r.start.row, r.end.col + 2));
     let title = str_param(p, "title").map(str::to_string).or_else(|| {
@@ -801,6 +866,7 @@ fn chart_switch(s: &mut Session, p: &Json) -> Result<Json> {
             c.source.get_or_insert(src);
             c.by_rows = by_rows;
             c.series = series;
+            scatter_x_from_first(c.kind, &mut c.series);
         }
         Ok(Json::Null)
     })
@@ -1114,6 +1180,7 @@ fn insert_link(s: &mut Session, p: &Json) -> Result<Json> {
     };
     let text = str_param(p, "text").map(str::to_string);
     let tooltip = str_param(p, "tooltip").map(str::to_string);
+    let external = links_outside(&s.doc()?.wb, sheet, &target);
     edit(s, |cx| {
         let link_style = cx.wb.styles.derive(cx.wb.sheet(sheet).map(|sh| sh.style_id(at)).unwrap_or_default(), |st| {
             st.font.color = Color::Theme(10, 0);
@@ -1125,12 +1192,55 @@ fn insert_link(s: &mut Session, p: &Json) -> Result<Json> {
         } else {
             sh.set_style(at, link_style);
         }
-        sh.hyperlinks.insert(at, Hyperlink { target: target.clone(), tooltip: tooltip.clone() });
+        sh.hyperlinks.insert(at, Hyperlink { target: target.clone(), tooltip: tooltip.clone(), external });
         cx.touch(sheet, at);
         Ok(Json::Null)
     })
 }
 
+/// Follows a link: a reference selects it, an `http`/`https`/`mailto` address is handed to the
+/// host (`UiRequest::OpenUrl`); anything else is refused ([`crate::links::classify`]). Opens no
+/// dialog; the interactive click asks for confirmation first, in the UI.
+fn open_link(s: &mut Session, p: &Json) -> Result<Json> {
+    let target = match str_param(p, "url").or_else(|| str_param(p, "target")) {
+        Some(t) => t.to_string(),
+        None => {
+            let sheet = target_sheet(s, p)?;
+            let at = cell_param_on(s, p, "cell", sheet)?.unwrap_or(s.doc()?.selection.active);
+            let Some(h) = s.doc()?.wb.sheet(sheet).and_then(|sh| sh.hyperlinks.get(&at)) else {
+                return Err(EngineError::Other("There's no hyperlink in this cell.".into()));
+            };
+            h.target.clone()
+        }
+    };
+    match crate::links::classify(&target) {
+        crate::links::LinkKind::Internal(r) => super::edit::go_to(s, &json!({"reference": r.trim_start_matches('#')})),
+        crate::links::LinkKind::External(u) => {
+            s.ui_requests.push(crate::UiRequest::OpenUrl(u.clone()));
+            Ok(json!({"opened": u}))
+        }
+        crate::links::LinkKind::Refused(why) => Err(EngineError::Other(why)),
+    }
+}
+
+/// Sorts a link target as the two pages of Excel's Insert Hyperlink dialog do: "Place in This
+/// Document" is a sheet reference, a defined name or `#…`; anything else ("Existing File or Web
+/// Page") is outside the workbook and saved as a relationship.
+fn links_outside(wb: &Workbook, sheet: usize, target: &str) -> bool {
+    let t = target.trim();
+    if t.starts_with('#') || wb.name(t, sheet).is_some() || wb.table(t).is_some() {
+        return false;
+    }
+    let (on, body) = split_sheet(t);
+    // Sheet names can't hold `: \ / ? * [ ]`, so `https://…!A1` or `C:\…!A1` is no sheet reference,
+    // and `Book.xlsx#Sheet1!A1` is a place in another file unless a sheet has that name.
+    let on_sheet = on.is_none_or(|name| {
+        wb.sheets.iter().any(|s| s.name.eq_ignore_ascii_case(&name))
+            || (!name.is_empty() && !name.contains([':', '\\', '/', '?', '*', '[', ']', '#']))
+    });
+    !(on_sheet && RangeRef::parse(body).is_some())
+}
+
 fn comment(s: &mut Session, p: &Json, threaded: bool) -> Result<Json> {
     let sheet = target_sheet(s, p)?;
     let at = cell_param_on(s, p, "cell", sheet)?.unwrap_or(s.doc()?.selection.active);
@@ -1378,20 +1488,20 @@ fn manage_cf(s: &mut Session, p: &Json) -> Result<Json> {
     }
     edit(s, |cx| {
         let sh = cx.sheet_mut(sheet)?;
-        let n = sh.cond_formats.len();
+        // The count is taken again after each step: a delete shortens the list.
         if let Some(i) = u32_param(p, "delete").map(|v| v as usize)
-            && i < n
+            && i < sh.cond_formats.len()
         {
             sh.cond_formats.remove(i);
         }
         if let Some(i) = u32_param(p, "moveUp").map(|v| v as usize)
             && i > 0
-            && i < n
+            && i < sh.cond_formats.len()
         {
             sh.cond_formats.swap(i, i - 1);
         }
         if let Some(i) = u32_param(p, "moveDown").map(|v| v as usize)
-            && i + 1 < n
+            && i + 1 < sh.cond_formats.len()
         {
             sh.cond_formats.swap(i, i + 1);
         }
@@ -1424,3 +1534,23 @@ fn insert_icon(s: &mut Session, p: &Json) -> Result<Json> {
         Ok(json!({"shape": id}))
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn manage_rules_delete_then_move() {
+        let mut s = Session::new();
+        s.new_workbook();
+        for v in ["1", "2"] {
+            let rule = json!({"type": "cellIs", "operator": "greaterThan", "value": v, "preset": "lightRedFill"});
+            s.execute("home.conditionalFormat", json!({"range": "A1:A3", "rule": rule})).unwrap();
+        }
+        // Deleting first left two rules' worth of indices for the move: it panicked.
+        s.execute("home.manageRules", json!({"delete": 0, "moveUp": 1})).unwrap();
+        s.execute("home.manageRules", json!({"delete": 0, "moveDown": 0})).unwrap();
+        let rules = s.execute("home.manageRules", json!({})).unwrap();
+        assert_eq!(rules["rules"].as_array().map(Vec::len), Some(0));
+    }
+}

crates/engine/src/cmd/inspect.rs

@@ -46,7 +46,7 @@ fn inspect(s: &mut Session, _: &Json) -> Result<Json> {
                 "freeze": sh.freeze,
                 "merges": sh.merges.iter().map(|m| m.a1()).collect::<Vec<_>>(),
                 "tables": sh.tables.iter().map(|t| json!({"name": t.name, "range": t.range.a1(), "style": t.style, "totals": t.totals_row, "columns": t.columns.iter().map(|c| c.name.clone()).collect::<Vec<_>>()})).collect::<Vec<_>>(),
-                "charts": sh.charts.iter().map(|c| json!({"id": c.id, "kind": format!("{:?}", c.kind), "title": c.title, "at": c.anchor.cell.a1(), "series": c.series.len()})).collect::<Vec<_>>(),
+                "charts": sh.charts.iter().map(|c| json!({"id": c.id, "kind": format!("{:?}", c.kind), "title": c.title, "at": c.anchor.cell.a1(), "series": c.series.len(), "trendlines": c.series.iter().flat_map(|s| s.trendlines.iter().map(|t| format!("{:?}", t.kind))).collect::<Vec<_>>()})).collect::<Vec<_>>(),
                 "images": sh.images.len(),
                 "shapes": sh.shapes.len(),
                 "conditionalFormats": sh.cond_formats.len(),

crates/engine/src/cmd/mod.rs

@@ -149,7 +149,42 @@ pub fn command_specs() -> &'static [CommandSpec] {
 }
 
 pub fn find_command(id: &str) -> Option<&'static CommandSpec> {
-    command_specs().iter().find(|c| c.id == id)
+    if let Some(spec) = command_specs().iter().find(|c| c.id == id) {
+        return Some(spec);
+    }
+    // Commands registered by UI integration tests (pending keytips go live
+    // the moment their command lands, with no table edit).
+    test_commands().iter().find(|c| c.id == id).copied()
+}
+
+static TEST_COMMANDS: std::sync::Mutex<Vec<&'static CommandSpec>> = std::sync::Mutex::new(Vec::new());
+
+/// Test-only: register an extra command so UI integration tests can prove a pending
+/// keytip becomes live the moment its command lands (see crates/ui-egui/tests/keytips.rs).
+/// Not part of the public API; harmless no-op for production callers who never call it.
+#[doc(hidden)]
+pub fn register_test_command(id: &'static str, run: Run) {
+    // Leaked intentionally: test commands live for the whole process.
+    let spec: &'static CommandSpec = Box::leak(Box::new(CommandSpec {
+        id,
+        label: id,
+        menu: &[],
+        shortcut: None,
+        params: "",
+        enabled: |_| Ok(()),
+        run,
+        journal: true,
+        undoable: false,
+    }));
+    test_commands().push(spec);
+}
+
+fn test_commands() -> std::sync::MutexGuard<'static, Vec<&'static CommandSpec>> {
+    #[allow(clippy::unwrap_used)] // a poisoned test registry has no meaningful recovery
+    match TEST_COMMANDS.lock() {
+        Ok(guard) => guard,
+        Err(poisoned) => poisoned.into_inner(),
+    }
 }
 
 // ---------------------------------------------------------------- param helpers
@@ -302,6 +337,9 @@ pub(crate) fn commit<R>(d: &mut DocState, f: impl FnOnce(&mut Ctx) -> Result<R>)
     if !protection_checked {
         check_protection(&d.wb, &wb, &d.unlocked_ranges)?;
     }
+    if !structural {
+        check_arrays(&d.wb, &wb)?;
+    }
     if changed.len() <= 200_000 {
         fit_rows.extend(changed.iter().map(|(s, c)| (*s, c.row)));
     }
@@ -372,6 +410,36 @@ pub(crate) fn locked_cell_error(sh: &gridcraft_model::Sheet, c: CellRef, unlocke
     })
 }
 
+/// Refuses an edit that put something into a cell of a multi-cell legacy array other than its
+/// formula cell, while the array stays (Excel: "You can't change part of an array."). The array
+/// would show its value there while the file kept the new content. Cells shifted by row and
+/// column edits aren't edits of their content, so structural commits aren't checked.
+fn check_arrays(old: &Workbook, new: &Workbook) -> Result<()> {
+    for sh in &old.sheets {
+        if sh.spill.is_empty() {
+            continue;
+        }
+        let Some(after) = new.sheet_index(&sh.name).and_then(|i| new.sheets.get(i)) else { continue };
+        if std::sync::Arc::ptr_eq(sh, after) {
+            continue;
+        }
+        for c in sh.cells.diff(&after.cells) {
+            let filled = after.cell(c).is_some_and(|x| x.formula.is_some() || !x.value.is_empty());
+            if !filled || !sh.spill.contains_key(&c) || same_content(sh.cell(c), after.cell(c)) {
+                continue;
+            }
+            let in_array = sh.spill_ranges.keys().any(|&anchor| {
+                anchor != c
+                    && after.cell(anchor).and_then(|x| x.formula.as_ref()).and_then(|f| f.array).is_some_and(|a| a.start == anchor && a.contains(c))
+            });
+            if in_array {
+                return Err(EngineError::Other("You can't change part of an array.".into()));
+            }
+        }
+    }
+    Ok(())
+}
+
 /// Two cells hold the same value or formula (formats aside).
 fn same_content(a: Option<&gridcraft_model::Cell>, b: Option<&gridcraft_model::Cell>) -> bool {
     let empty = |c: Option<&gridcraft_model::Cell>| c.is_none_or(|c| c.formula.is_none() && c.value.is_empty());

crates/engine/src/cmd/pivot.rs

@@ -87,7 +87,7 @@ pub fn specs() -> Vec<CommandSpec> {
             "Move Field",
             [],
             None,
-            "{pivot?, field, from: rows|columns|values|filters, to: rows|columns|values|filters, position?: index, replace?}",
+            "{pivot?, field (\"Σ Values\" moves the value fields between rows and columns; in columns it stays after the last field), from: rows|columns|values|filters, to: rows|columns|values|filters, position?: index, replace?}",
             has_doc,
             move_field
         ),
@@ -333,6 +333,71 @@ fn in_axes(pt: &PivotTable, field: &str) -> bool {
     pt.rows.iter().chain(pt.columns.iter()).any(|f| f.source_col.eq_ignore_ascii_case(field))
 }
 
+/// Name of the Σ Values pseudo-field (where the value fields sit when there are two or more).
+const VALUES_FIELD: &str = "Σ Values";
+
+/// Whether `field` names Σ Values: `Σ Values`, or `Values` unless a source field has that name.
+fn is_values_field(src: &pv::Source, field: &str) -> bool {
+    let f = field.trim();
+    f == VALUES_FIELD || (f.eq_ignore_ascii_case("values") && src.col(f).is_none())
+}
+
+/// Keeps Σ Values in place after a field left (`inserted` false) or arrived at index `i` of
+/// Rows (`rows`) or Columns.
+fn shift_values(pt: &mut PivotTable, rows: bool, i: usize, inserted: bool) {
+    if pt.values_on_rows != rows {
+        return;
+    }
+    let Some(p) = pt.values_position else { return };
+    // Σ Values stays just ahead of the field it preceded.
+    let p = match inserted {
+        true if i <= p => p + 1,
+        false if i < p => p - 1,
+        _ => p,
+    };
+    let n = if rows { pt.rows.len() } else { pt.columns.len() };
+    pt.values_position = (p < n).then_some(p);
+}
+
+/// Takes `field` out of Rows and Columns (Σ Values keeps its place); returns its first entry.
+fn take_from_axes(pt: &mut PivotTable, field: &str) -> Option<PivotField> {
+    let mut first = None;
+    for rows in [true, false] {
+        loop {
+            let list = if rows { &mut pt.rows } else { &mut pt.columns };
+            let Some(i) = list.iter().position(|f| f.source_col.eq_ignore_ascii_case(field)) else { break };
+            let f = list.remove(i);
+            shift_values(pt, rows, i, false);
+            first.get_or_insert(f);
+        }
+    }
+    first
+}
+
+/// Inserts `f` into Rows (`rows`) or Columns at `position` (default: the end).
+fn insert_axis_field(pt: &mut PivotTable, rows: bool, f: PivotField, position: Option<usize>) {
+    let list = if rows { &mut pt.rows } else { &mut pt.columns };
+    let at = position.unwrap_or(list.len()).min(list.len());
+    list.insert(at, f);
+    shift_values(pt, rows, at, true);
+}
+
+/// Moves Σ Values between Rows and Columns, or within Rows, to `position` (default: the end).
+/// In Columns it always comes after the last column field: the column layout doesn't place it
+/// anywhere else yet.
+fn move_values_field(cmd: &str, pt: &mut PivotTable, from: &str, to: &str, position: Option<usize>) -> Result<Json> {
+    let current = if pt.values_on_rows { "rows" } else { "columns" };
+    if from != current {
+        return Err(bad(cmd, format!("`{VALUES_FIELD}` isn't in the {from} area")));
+    }
+    if !matches!(to, "rows" | "columns") {
+        return Err(other("The field you are moving cannot be placed in that PivotTable area."));
+    }
+    pt.values_on_rows = to == "rows";
+    pt.values_position = position.filter(|p| pt.values_on_rows && *p < pt.rows.len());
+    Ok(json!({"field": VALUES_FIELD, "to": to}))
+}
+
 /// The canonical source field name for `field`.
 fn canonical(cmd: &str, src: &pv::Source, field: &str) -> Result<String> {
     src.col(field).and_then(|c| src.headers.get(c).cloned()).ok_or_else(|| bad(cmd, format!("no field `{field}` in the source data")))
@@ -384,21 +449,11 @@ fn add_to_area(
             if pt.rows.len() + pt.columns.len() >= pv::MAX_AXIS_FIELDS && !in_axes(pt, &field) {
                 return Err(other(format!("A PivotTable can have at most {} row and column fields.", pv::MAX_AXIS_FIELDS)));
             }
-            let existing = pt
-                .rows
-                .iter()
-                .chain(pt.columns.iter())
-                .find(|f| f.source_col.eq_ignore_ascii_case(&field))
-                .cloned()
-                .unwrap_or_else(|| PivotField { source_col: field.clone(), ..Default::default() });
-            pt.rows.retain(|f| !f.source_col.eq_ignore_ascii_case(&field));
-            pt.columns.retain(|f| !f.source_col.eq_ignore_ascii_case(&field));
+            let existing = take_from_axes(pt, &field).unwrap_or_else(|| PivotField { source_col: field.clone(), ..Default::default() });
             // A report filter that selects nothing in particular goes away; a selection stays
             // as the field's hidden items.
             pt.filters.retain(|f| !(f.source_col.eq_ignore_ascii_case(&field) && f.selected.is_none()));
-            let list = if area == "rows" { &mut pt.rows } else { &mut pt.columns };
-            let at = position.unwrap_or(list.len()).min(list.len());
-            list.insert(at, existing);
+            insert_axis_field(pt, area == "rows", existing, position);
         }
         "values" => {
             if pt.values.len() >= pv::MAX_VALUE_FIELDS {
@@ -421,8 +476,7 @@ fn add_to_area(
             pt.values.insert(at, v);
         }
         _ => {
-            pt.rows.retain(|f| !f.source_col.eq_ignore_ascii_case(&field));
-            pt.columns.retain(|f| !f.source_col.eq_ignore_ascii_case(&field));
+            take_from_axes(pt, &field);
             let existing = pt.filters.iter().position(|f| f.source_col.eq_ignore_ascii_case(&field));
             let entry = match existing {
                 Some(i) => pt.filters.remove(i),
@@ -439,12 +493,14 @@ fn add_to_area(
 fn remove_from_area(cmd: &str, pt: &mut PivotTable, field: &str, area: &str) -> Result<String> {
     match area {
         "rows" | "columns" => {
-            let list = if area == "rows" { &mut pt.rows } else { &mut pt.columns };
+            let rows = area == "rows";
+            let list = if rows { &mut pt.rows } else { &mut pt.columns };
             let i = list
                 .iter()
                 .position(|f| f.source_col.eq_ignore_ascii_case(field))
                 .ok_or_else(|| bad(cmd, format!("`{field}` isn't in the {area} area")))?;
             let f = list.remove(i);
+            shift_values(pt, rows, i, false);
             pt.filters.retain(|x| !x.source_col.eq_ignore_ascii_case(&f.source_col));
             Ok(f.source_col)
         }
@@ -699,6 +755,8 @@ fn pivot_json(wb: &Workbook, si: usize, pt: &PivotTable) -> Json {
         "style": pt.style,
         "showHeaders": pt.show_headers,
         "calculatedFields": pt.calculated_fields.iter().map(|c| json!({"name": c.name, "formula": c.formula})).collect::<Vec<_>>(),
+        "valuesOnRows": pt.values_on_rows,
+        "valuesPosition": pt.values_position,
     })
 }
 
@@ -890,18 +948,22 @@ fn move_field(s: &mut Session, p: &Json) -> Result<Json> {
     let to = area_param(C, str_param(p, "to"))?;
     let pos = position_param(p);
     update(s, p, |pt, src, _| {
+        if is_values_field(src, &field) {
+            return move_values_field(C, pt, from, to, pos);
+        }
         if from == to {
             // Reorder within the area.
             match from {
                 "rows" | "columns" => {
-                    let list = if from == "rows" { &mut pt.rows } else { &mut pt.columns };
+                    let rows = from == "rows";
+                    let list = if rows { &mut pt.rows } else { &mut pt.columns };
                     let i = list
                         .iter()
                         .position(|f| f.source_col.eq_ignore_ascii_case(&field))
                         .ok_or_else(|| bad(C, format!("`{field}` isn't in the {from} area")))?;
                     let f = list.remove(i);
-                    let at = pos.unwrap_or(list.len()).min(list.len());
-                    list.insert(at, f);
+                    shift_values(pt, rows, i, false);
+                    insert_axis_field(pt, rows, f, pos);
                 }
                 "values" => {
                     let i = pt
@@ -1270,8 +1332,20 @@ fn change_source(s: &mut Session, p: &Json) -> Result<Json> {
             }
             ok
         };
-        pt.rows.retain(|f| keep(&f.source_col, &mut dropped));
-        pt.columns.retain(|f| keep(&f.source_col, &mut dropped));
+        // Axis fields leave one by one so Σ Values keeps its place among the rest.
+        for rows in [true, false] {
+            let mut i = 0;
+            loop {
+                let list = if rows { &mut pt.rows } else { &mut pt.columns };
+                let Some(f) = list.get(i) else { break };
+                if keep(&f.source_col, &mut dropped) {
+                    i += 1;
+                } else {
+                    list.remove(i);
+                    shift_values(pt, rows, i, false);
+                }
+            }
+        }
         pt.values.retain(|f| keep(&f.source_col, &mut dropped));
         pt.filters.retain(|f| keep(&f.source_col, &mut dropped));
         Ok(json!({"source": source, "dropped": dropped}))
@@ -1722,6 +1796,167 @@ mod tests {
         assert_eq!(text(&s, "A5"), "Apples");
     }
 
+    #[test]
+    fn values_on_rows_layouts() {
+        let mut s = sales();
+        s.execute("insert.pivotTable", json!({"rows": ["Region"], "values": ["Sales", "Units"]})).unwrap();
+        assert_eq!(text(&s, "C3"), "Sum of Units");
+        // Σ Values after Region: each region holds one line per value field.
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "rows"})).unwrap();
+        let p = pt(&s);
+        assert!(p.values_on_rows);
+        assert_eq!(p.values_position, None);
+        let r = p.last_range.unwrap();
+        assert_eq!(r.width(), 2);
+        // header + 3 × (region + 2 values) + 2 grand totals
+        assert_eq!(r.height(), 1 + 9 + 2);
+        assert_eq!(text(&s, "A4"), "East");
+        assert_eq!(val(&s, "B4"), Value::Empty);
+        assert_eq!(text(&s, "A5"), "Sum of Sales");
+        assert_eq!(val(&s, "B5"), Value::Number(415.0));
+        assert_eq!(text(&s, "A6"), "Sum of Units");
+        assert_eq!(val(&s, "B6"), Value::Number(33.0));
+        assert_eq!(text(&s, "A13"), "Total Sum of Sales");
+        assert_eq!(val(&s, "B13"), Value::Number(TOTAL));
+        assert_eq!(text(&s, "A14"), "Total Sum of Units");
+        assert_eq!(val(&s, "B14"), Value::Number(72.0));
+        // Tabular, no column field: "Total" heads the data column, as Excel saves it.
+        s.execute("pivot.layout", json!({"layout": "tabular"})).unwrap();
+        assert_eq!(text(&s, "A3"), "Region");
+        assert_eq!(text(&s, "B3"), "Values");
+        assert_eq!(text(&s, "C3"), "Total");
+        s.execute("pivot.layout", json!({"layout": "compact"})).unwrap();
+        // Σ Values before Region: the value fields are the outer items.
+        s.execute("pivot.moveField", json!({"field": "Values", "from": "rows", "to": "rows", "position": 0})).unwrap();
+        assert_eq!(pt(&s).values_position, Some(0));
+        assert_eq!(text(&s, "A4"), "Sum of Sales");
+        assert_eq!(val(&s, "B4"), Value::Empty);
+        assert_eq!(text(&s, "A5"), "East");
+        assert_eq!(val(&s, "B5"), Value::Number(415.0));
+        assert_eq!(text(&s, "A8"), "Sum of Units");
+        assert_eq!(text(&s, "A9"), "East");
+        assert_eq!(val(&s, "B9"), Value::Number(33.0));
+        assert_eq!(text(&s, "A12"), "Total Sum of Sales");
+        assert_eq!(val(&s, "B13"), Value::Number(72.0));
+        // Adding a row field in front keeps Σ Values ahead of Region.
+        s.execute("pivot.addField", json!({"field": "Product", "area": "rows", "position": 0})).unwrap();
+        assert_eq!(pt(&s).values_position, Some(1));
+        s.execute("pivot.removeField", json!({"field": "Product", "area": "rows"})).unwrap();
+        assert_eq!(pt(&s).values_position, Some(0));
+        // No row field: one line per value field and no grand total.
+        s.execute("pivot.removeField", json!({"field": "Region", "area": "rows"})).unwrap();
+        let r = pt(&s).last_range.unwrap();
+        assert_eq!(r.height(), 1 + 2);
+        assert_eq!(text(&s, "A4"), "Sum of Sales");
+        assert_eq!(val(&s, "B4"), Value::Number(TOTAL));
+        assert_eq!(text(&s, "A5"), "Sum of Units");
+        assert_eq!(val(&s, "B5"), Value::Number(72.0));
+        // Back to Columns.
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "rows", "to": "columns"})).unwrap();
+        assert!(!pt(&s).values_on_rows);
+        assert_eq!(text(&s, "A3"), "Sum of Sales");
+        assert_eq!(text(&s, "B3"), "Sum of Units");
+        assert!(s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "filters"})).is_err());
+        assert!(s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "rows", "to": "columns"})).is_err());
+    }
+
+    #[test]
+    fn collapsed_item_puts_values_in_the_values_column() {
+        let mut s = sales();
+        s.execute("insert.pivotTable", json!({"rows": ["Region", "Product"], "values": ["Sales", "Units"]})).unwrap();
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "rows"})).unwrap();
+        s.execute("pivot.collapse", json!({"field": "Region", "items": ["East"]})).unwrap();
+        for layout in ["tabular", "outline"] {
+            s.execute("pivot.layout", json!({"layout": layout})).unwrap();
+            assert_eq!(text(&s, "C3"), "Values", "{layout}");
+            let east = (4..20).find(|r| text(&s, &format!("A{r}")) == "East").unwrap();
+            let first = if layout == "tabular" { east } else { east + 1 };
+            assert_eq!(text(&s, &format!("B{first}")), "", "{layout}");
+            assert_eq!(text(&s, &format!("C{first}")), "Sum of Sales", "{layout}");
+            assert_eq!(val(&s, &format!("D{first}")), Value::Number(415.0), "{layout}");
+            assert_eq!(text(&s, &format!("C{}", first + 1)), "Sum of Units", "{layout}");
+        }
+    }
+
+    #[test]
+    fn values_stay_last_in_columns() {
+        let mut s = sales();
+        s.execute("insert.pivotTable", json!({"rows": ["Product"], "columns": ["Region"], "values": ["Sales", "Units"]})).unwrap();
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "columns", "position": 0})).unwrap();
+        let p = pt(&s);
+        assert!(!p.values_on_rows);
+        assert_eq!(p.values_position, None);
+        // Σ Values to Rows and back with a position: still last in Columns.
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "rows"})).unwrap();
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "rows", "to": "columns", "position": 0})).unwrap();
+        assert_eq!(pt(&s).values_position, None);
+        assert_eq!(text(&s, "B5"), "Sum of Sales");
+        assert_eq!(text(&s, "C5"), "Sum of Units");
+    }
+
+    #[test]
+    fn change_source_keeps_values_ahead_of_its_field() {
+        let mut s = sales();
+        s.execute("insert.pivotTable", json!({"rows": ["Region", "Product"], "values": ["Sales", "Units"]})).unwrap();
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "rows", "position": 1})).unwrap();
+        // The new source has no Region: Σ Values stays ahead of Product.
+        s.execute("pivot.changeSource", json!({"source": "Sheet1!B1:E13"})).unwrap();
+        let p = pt(&s);
+        assert_eq!(p.rows.len(), 1);
+        assert_eq!(p.values_position, Some(0));
+        assert_eq!(text(&s, "A4"), "Sum of Sales");
+        assert_eq!(text(&s, "A5"), "Apples");
+    }
+
+    #[test]
+    fn values_on_rows_between_row_fields() {
+        let mut s = sales();
+        s.execute("insert.pivotTable", json!({"rows": ["Region", "Product"], "values": ["Sales", "Units"]})).unwrap();
+        s.execute("pivot.moveField", json!({"field": "Σ Values", "from": "columns", "to": "rows", "position": 1})).unwrap();
+        // Compact: East, then per value field its products, then per-value subtotals of East.
+        assert_eq!(text(&s, "A4"), "East");
+        assert_eq!(text(&s, "A5"), "Sum of Sales");
+        assert_eq!(text(&s, "A6"), "Apples");
+        assert_eq!(val(&s, "B6"), Value::Number(160.0));
+        assert_eq!(text(&s, "A9"), "Sum of Units");
+        assert_eq!(text(&s, "A10"), "Apples");
+        assert_eq!(val(&s, "B10"), Value::Number(16.0));
+        assert_eq!(text(&s, "A13"), "East Sum of Sales");
+        assert_eq!(val(&s, "B13"), Value::Number(415.0));
+        assert_eq!(text(&s, "A14"), "East Sum of Units");
+        assert_eq!(val(&s, "B14"), Value::Number(33.0));
+        let d = s.doc().unwrap();
+        let sh = d.wb.active().unwrap();
+        assert_eq!(d.wb.styles.get(sh.style_id(CellRef::parse("A5").unwrap())).align.indent, 1);
+        assert_eq!(d.wb.styles.get(sh.style_id(CellRef::parse("A6").unwrap())).align.indent, 2);
+        // Outline: one column per level, "Values" heads the Σ Values column.
+        s.execute("pivot.layout", json!({"layout": "outline"})).unwrap();
+        assert_eq!(pt(&s).last_range.unwrap().width(), 4);
+        assert_eq!(text(&s, "A3"), "Region");
+        assert_eq!(text(&s, "B3"), "Values");
+        assert_eq!(text(&s, "C3"), "Product");
+        assert_eq!(text(&s, "B5"), "Sum of Sales");
+        assert_eq!(text(&s, "C6"), "Apples");
+        assert_eq!(val(&s, "D6"), Value::Number(160.0));
+        // Tabular: labels start on their parent's row; totals per value field below each group.
+        s.execute("pivot.layout", json!({"layout": "tabular"})).unwrap();
+        assert_eq!(text(&s, "A4"), "East");
+        assert_eq!(text(&s, "B4"), "Sum of Sales");
+        assert_eq!(text(&s, "C4"), "Apples");
+        assert_eq!(val(&s, "D4"), Value::Number(160.0));
+        assert_eq!(text(&s, "B7"), "Sum of Units");
+        assert_eq!(text(&s, "C7"), "Apples");
+        assert_eq!(val(&s, "D7"), Value::Number(16.0));
+        assert_eq!(text(&s, "A10"), "East Sum of Sales");
+        assert_eq!(val(&s, "D10"), Value::Number(415.0));
+        assert_eq!(text(&s, "A11"), "East Sum of Units");
+        let r = pt(&s).last_range.unwrap();
+        let last = r.end.row + 1;
+        assert_eq!(text(&s, &format!("A{}", last - 1)), "Total Sum of Sales");
+        assert_eq!(text(&s, &format!("A{last}")), "Total Sum of Units");
+        assert_eq!(val(&s, &format!("D{last}")), Value::Number(72.0));
+    }
+
     #[test]
     fn refresh_after_source_edits() {
         let mut s = sales();
@@ -2039,4 +2274,38 @@ mod tests {
         assert!(e.contains("field name is not valid"), "{e}");
         assert!(s.execute("insert.pivotTable", json!({"source": "NoSuchTable"})).is_err());
     }
+
+    #[test]
+    fn too_many_value_columns_are_refused() {
+        let mut s = Session::new();
+        s.new_workbook();
+        let mut records: Vec<Json> = vec![json!(["Cat", "Sub", "V"])];
+        for r in 0..64 {
+            for c in 0..64 {
+                records.push(json!([format!("c{r}"), format!("s{c}"), 1.0]));
+            }
+        }
+        s.execute("range.setValues", json!({"range": "A1", "values": records})).unwrap();
+        let req = |n: usize| {
+            let values: Vec<Json> = (0..n).map(|_| json!({"field": "V"})).collect();
+            json!({"source": "A1:C4097", "rows": ["Cat"], "columns": ["Sub"], "values": values})
+        };
+        let e = s.execute("insert.pivotTable", req(256)).unwrap_err().to_string();
+        assert!(e.contains("will not fit"), "{e}");
+        assert!(s.execute("insert.pivotTable", req(128)).is_ok());
+    }
+
+    #[test]
+    fn collapsed_column_items_count_as_one_column_group() {
+        let mut s = Session::new();
+        s.new_workbook();
+        let mut records: Vec<Json> = vec![json!(["Grp", "Sub", "V"])];
+        records.extend((0..64).map(|c| json!(["g", format!("s{c}"), 1.0])));
+        s.execute("range.setValues", json!({"range": "A1", "values": records})).unwrap();
+        let values: Vec<Json> = (0..256).map(|_| json!({"field": "V"})).collect();
+        s.execute("insert.pivotTable", json!({"source": "A1:C65", "columns": ["Grp"], "values": values})).unwrap();
+        s.execute("pivot.collapse", json!({"field": "Grp"})).unwrap();
+        // 64 Sub items under the collapsed "g" show as one column group: (1 + grand total) x 256 columns fit.
+        s.execute("pivot.addField", json!({"field": "Sub", "area": "columns"})).unwrap();
+    }
 }

crates/engine/src/cmd/print.rs

@@ -391,7 +391,7 @@ pub struct HfContext {
 
 /// Today's date and the current time as headers and footers show them (`&D`, `&T`).
 pub fn hf_date_time(wb: &Workbook) -> (String, String) {
-    let now = gridcraft_calc::now_serial();
+    let now = gridcraft_core::date::serial_in_system(wb.date_system, gridcraft_calc::now_serial());
     let date = crate::display::format(&Value::Number(now.floor()), "m/d/yyyy", wb).text;
     let time = crate::display::format(&Value::Number(now), "h:mm AM/PM", wb).text;
     (date, time)
@@ -1027,6 +1027,21 @@ fn empty_for_overflow(sh: &Sheet, c: CellRef, merges: &[RangeRef]) -> bool {
     sh.value_ref(c).is_none_or(|v| v.is_empty()) && !merges.iter().any(|m| m.contains(c))
 }
 
+/// Unscaled width of the empty Center Across Selection cells right of `c`, which its text is centred over too.
+fn center_across_width(styles: &StyleTable, sh: &Sheet, c: CellRef, merges: &[RangeRef]) -> f32 {
+    let mut ext = 0.0;
+    let mut col = c.col + 1;
+    while col < MAX_COLS && ext < 20_000.0 {
+        let nc = CellRef::new(c.row, col);
+        if !empty_for_overflow(sh, nc, merges) || styles.get(sh.style_id(nc)).align.h != HAlign::CenterAcross {
+            break;
+        }
+        ext += sh.col_width(col);
+        col += 1;
+    }
+    ext
+}
+
 fn draw_text(pg: &mut Page, b: &Block, c: CellRef, l: &Look, rect: (f32, f32, f32, f32), merged: bool, merges: &[RangeRef], limits: (f32, f32)) {
     let (x, y, w, h) = rect;
     let sh = b.sh;
@@ -1110,8 +1125,11 @@ fn draw_text(pg: &mut Page, b: &Block, c: CellRef, l: &Look, rect: (f32, f32, f3
         VAlign::Bottom => y + h - pad - size * 0.22 - (n - 1.0) * line_h,
     };
     // Overflow into empty neighbours (single-line text, not merged).
-    let (mut clip_l, mut clip_r) = (x, x + w);
-    if !wrap && !merged && !is_num && rot.abs() != 90 && tw + 2.0 * pad + indent > w {
+    // Center Across Selection spans the empty Center Across cells to its right; the text stays within that run.
+    let spans = st.align.h == HAlign::CenterAcross && !wrap && !merged && rot == 0;
+    let across = if spans { center_across_width(&wb.styles, sh, c, merges) * b.k } else { 0.0 };
+    let (mut clip_l, mut clip_r) = (x, x + w + across);
+    if !wrap && !merged && !is_num && rot.abs() != 90 && across <= 0.0 && tw + 2.0 * pad + indent > w {
         let need = tw + 2.0 * pad + indent - w;
         let grow = |dir: i64, mut need: f32| -> f32 {
             let mut ext = 0.0;
@@ -1183,7 +1201,7 @@ fn draw_text(pg: &mut Page, b: &Block, c: CellRef, l: &Look, rect: (f32, f32, f3
         let lw = gridcraft_pdf::text_width(font, size, line);
         let lx = match h_align {
             HAlign::Right => x + w - pad - lw - indent,
-            HAlign::Center => x + (w - lw) / 2.0,
+            HAlign::Center => x + (w + across - lw) / 2.0,
             _ => x + pad + indent,
         };
         let ly = first_baseline + i as f32 * line_h;
@@ -1765,6 +1783,14 @@ mod tests {
         }
     }
 
+    #[test]
+    fn header_footer_date_follows_the_workbook_date_system() {
+        let mut wb = Workbook::new();
+        let date_1900 = hf_date_time(&wb).0;
+        wb.date_system = gridcraft_core::DateSystem::D1904;
+        assert_eq!(hf_date_time(&wb).0, date_1900);
+    }
+
     #[test]
     fn header_footer_section_edits_are_undoable_and_views_are_per_sheet() {
         let mut s = s();
@@ -2046,6 +2072,23 @@ mod tests {
         assert!(s.execute("file.exportPdf", json!({})).is_ok());
     }
 
+    #[test]
+    fn export_pdf_without_a_path_returns_bytes_and_never_opens_a_dialog() {
+        let mut s = s();
+        for params in [json!({}), json!({"path": ""}), json!({"path": null})] {
+            let r = s.execute("file.exportPdf", params).unwrap();
+            assert!(r.get("path").is_none(), "no file is written without a path");
+            let bytes = crate::io::base64_decode(r["base64"].as_str().unwrap()).unwrap();
+            assert!(bytes.starts_with(b"%PDF-"));
+        }
+        assert!(s.take_ui_requests().is_empty(), "a programmatic call never queues a dialog");
+        // Headless callers (CLI, MCP) get the same bytes, not an error.
+        assert!(s.execute_headless("file.exportPdf", json!({})).is_ok());
+        // With no workbook open it is a clear error, not a panic.
+        let mut none = Session::new();
+        assert!(none.execute("file.exportPdf", json!({})).is_err());
+    }
+
     #[test]
     fn bands_unit() {
         let b = bands(0, 9, |_| 10.0, |_| 35.0, &[], 100);
@@ -2063,6 +2106,23 @@ mod tests {
         assert!(w.len() > 2);
     }
 
+    #[test]
+    fn center_across_spans_following_empty_center_across_cells() {
+        let mut styles = StyleTable::default();
+        let across = styles.intern(Style { align: Alignment { h: HAlign::CenterAcross, ..Alignment::default() }, ..Style::default() });
+        let mut sh = Sheet::new("S");
+        for col in 0..3 {
+            sh.set_style(CellRef::new(0, col), across);
+        }
+        sh.set_value(CellRef::new(0, 0), Value::Text("Title".into()));
+        let a1 = CellRef::new(0, 0);
+        assert_eq!(center_across_width(&styles, &sh, a1, &[]), sh.col_width(1) + sh.col_width(2));
+        sh.set_value(CellRef::new(0, 2), Value::Text("x".into()));
+        assert_eq!(center_across_width(&styles, &sh, a1, &[]), sh.col_width(1));
+        let merged = [RangeRef::new(CellRef::new(0, 1), CellRef::new(1, 1))];
+        assert_eq!(center_across_width(&styles, &sh, a1, &merged), 0.0);
+    }
+
     #[test]
     fn rotated_wrapped_text_prints_rotated() {
         // Upright headers over narrow columns (mark sheets) combine rotation with Wrap Text.

crates/engine/src/cmd/sheet.rs

@@ -167,27 +167,8 @@ fn shift_sheet_features(sh: &mut Sheet, axis: Axis, at: u32, count: u32, insert:
     sh.validations.retain(|dv| !dv.ranges.is_empty());
     for t in sh.tables.iter_mut() {
         if let Some(r) = map_range(t.range) {
-            // Columns inserted inside a table become new table columns.
-            if axis == Axis::Cols && insert && at > t.range.start.col && at <= t.range.end.col {
-                let idx = (at - t.range.start.col) as usize;
-                for k in 0..count {
-                    let name = format!("Column{}", t.columns.len() + 1);
-                    t.columns.insert(
-                        (idx + k as usize).min(t.columns.len()),
-                        gridcraft_model::TableColumn { name, totals: Default::default(), totals_label: None, formula: None },
-                    );
-                }
-            }
-            if axis == Axis::Cols && !insert {
-                let lo = at.max(t.range.start.col);
-                let hi = (at + count).min(t.range.end.col + 1);
-                if hi > lo {
-                    let a = (lo - t.range.start.col) as usize;
-                    let b = (hi - t.range.start.col) as usize;
-                    if b <= t.columns.len() {
-                        t.columns.drain(a..b);
-                    }
-                }
+            if axis == Axis::Cols {
+                shift_table_columns(t, at, count, insert);
             }
             t.range = r;
         } else {
@@ -268,10 +249,14 @@ fn cancel_copy_mode(s: &mut Session) {
 
 fn insert_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
     let (at, count) = lines(s, p, axis)?;
+    let limit = if axis == Axis::Rows { MAX_ROWS } else { MAX_COLS };
+    if at.checked_add(count).is_none_or(|end| end > limit) {
+        let cmd = if axis == Axis::Rows { "home.insertRows" } else { "home.insertColumns" };
+        return Err(bad(cmd, "the inserted lines would extend past the end of the worksheet"));
+    }
     check_lines_protection(s, p, axis, at, count, true)?;
     let sheet = target_sheet(s, p)?;
     // Refuse to push data off the sheet.
-    let limit = if axis == Axis::Rows { MAX_ROWS } else { MAX_COLS };
     if let Some(u) = s.doc()?.wb.sheet(sheet).and_then(|sh| sh.used_range()) {
         let last = if axis == Axis::Rows { u.end.row } else { u.end.col };
         if last >= at && last as u64 + count as u64 >= limit as u64 {
@@ -307,27 +292,65 @@ fn insert_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
     Ok(out)
 }
 
+/// The areas a line delete/insert targets as `(first line, count)`, merged and sorted from the
+/// last line to the first so deleting one never shifts the next. A comma-separated list
+/// (`"3:3,7:8"`) or a multi-area selection yields several; `count` forces the single-area form.
+fn delete_areas(s: &Session, p: &Json, axis: Axis) -> Result<Vec<(u32, u32)>> {
+    let key = if axis == Axis::Rows { "rows" } else { "cols" };
+    let spans: Vec<(u32, u32)> = if u32_param(p, "count").is_some() {
+        let (at, count) = lines(s, p, axis)?;
+        let limit = if axis == Axis::Rows { MAX_ROWS } else { MAX_COLS };
+        // Deleting past the last line only removes up to the end of the worksheet.
+        let count = count.min(limit.saturating_sub(at)).max(1);
+        vec![(at, at.saturating_add(count - 1))]
+    } else if let Some(t) = str_param(p, key).or_else(|| str_param(p, "range")) {
+        t.split(',')
+            .map(|part| {
+                let r = RangeRef::parse(part).ok_or_else(|| bad(key, format!("not a range: {part}")))?;
+                Ok(if axis == Axis::Rows { (r.start.row, r.end.row) } else { (r.start.col, r.end.col) })
+            })
+            .collect::<Result<_>>()?
+    } else {
+        s.doc()?.selection.ranges.iter().map(|r| if axis == Axis::Rows { (r.start.row, r.end.row) } else { (r.start.col, r.end.col) }).collect()
+    };
+    let mut spans: Vec<(u32, u32)> = spans.into_iter().map(|(a, b)| (a.min(b), a.max(b))).collect();
+    spans.sort_unstable();
+    let mut merged: Vec<(u32, u32)> = Vec::new();
+    for (a, b) in spans {
+        match merged.last_mut() {
+            Some(last) if a <= last.1.saturating_add(1) => last.1 = last.1.max(b),
+            _ => merged.push((a, b)),
+        }
+    }
+    Ok(merged.into_iter().rev().map(|(a, b)| (a, b - a + 1)).collect())
+}
+
 fn delete_lines(s: &mut Session, p: &Json, axis: Axis) -> Result<Json> {
-    let (at, count) = lines(s, p, axis)?;
-    check_lines_protection(s, p, axis, at, count, false)?;
+    let areas = delete_areas(s, p, axis)?;
+    for &(at, count) in &areas {
+        check_lines_protection(s, p, axis, at, count, false)?;
+    }
     let sheet = target_sheet(s, p)?;
     let out = edit(s, |cx| {
         let name = cx.wb.sheet(sheet).map(|s| s.name.clone()).unwrap_or_default();
         cx.protection_checked = true;
-        {
-            let sh = cx.sheet_mut(sheet)?;
-            let block = match axis {
-                Axis::Rows => RangeRef::rows(at, (at + count - 1).min(MAX_ROWS - 1)),
-                Axis::Cols => RangeRef::cols(at, (at + count - 1).min(MAX_COLS - 1)),
-            };
-            sh.take_cells(block);
-            match axis {
-                Axis::Rows => sh.cells.shift_rows(at + count, -(count as i64)),
-                Axis::Cols => sh.cells.shift_cols(at + count, -(count as i64)),
+        // Last area first, so the earlier ones keep their positions.
+        for (at, count) in areas {
+            {
+                let sh = cx.sheet_mut(sheet)?;
+                let block = match axis {
+                    Axis::Rows => RangeRef::rows(at, (at + count - 1).min(MAX_ROWS - 1)),
+                    Axis::Cols => RangeRef::cols(at, (at + count - 1).min(MAX_COLS - 1)),
+                };
+                sh.take_cells(block);
+                match axis {
+                    Axis::Rows => sh.cells.shift_rows(at + count, -(count as i64)),
+                    Axis::Cols => sh.cells.shift_cols(at + count, -(count as i64)),
+                }
+                shift_sheet_features(sh, axis, at, count, false);
             }
-            shift_sheet_features(sh, axis, at, count, false);
+            rewrite(&mut cx.wb, &name, &Edit::Delete { axis, at, count });
         }
-        rewrite(&mut cx.wb, &name, &Edit::Delete { axis, at, count });
         cx.structural = true;
         Ok(Json::Null)
     })?;
@@ -444,6 +467,9 @@ fn insert_cells(s: &mut Session, p: &Json) -> Result<Json> {
     }
     let e = Edit::InsertCells { axis: if shift == "right" { Axis::Cols } else { Axis::Rows }, range: r };
     let sheet = target_sheet(s, p)?;
+    if let Some(sh) = s.doc()?.wb.sheet(sheet) {
+        check_table_shift(sh, &e)?;
+    }
     let right = shift == "right";
     let out = edit(s, |cx| {
         let sh = cx.sheet_mut(sheet)?;
@@ -472,6 +498,9 @@ fn delete_cells(s: &mut Session, p: &Json) -> Result<Json> {
     }
     let e = Edit::DeleteCells { axis: if shift == "left" { Axis::Cols } else { Axis::Rows }, range: r };
     let sheet = target_sheet(s, p)?;
+    if let Some(sh) = s.doc()?.wb.sheet(sheet) {
+        check_table_shift(sh, &e)?;
+    }
     let left = shift == "left";
     let out = edit(s, |cx| {
         let name = cx.wb.sheet(sheet).map(|s| s.name.clone()).unwrap_or_default();
@@ -798,8 +827,16 @@ fn move_sheet(s: &mut Session, p: &Json) -> Result<Json> {
         if copy {
             let mut sh = (*src).clone();
             let base = sh.name.clone();
-            let name = (2..).map(|k| format!("{base} ({k})")).find(|nm| cx.wb.sheet_index(nm).is_none()).unwrap_or(base.clone());
-            sh.name = name.chars().take(31).collect();
+            // `Name (2)`: the name is shortened so the suffix fits in Excel's 31 characters.
+            let name = (2..)
+                .map(|k| {
+                    let suffix = format!(" ({k})");
+                    let keep = 31usize.saturating_sub(suffix.chars().count());
+                    format!("{}{suffix}", base.chars().take(keep).collect::<String>().trim_end())
+                })
+                .find(|nm| cx.wb.sheet_index(nm).is_none())
+                .unwrap_or(base.clone());
+            sh.name = name;
             sh.tables.clear(); // table names must be unique
             sh.preserved = None; // kept file content (form controls, OLE objects…) stays with the original
             let at = to.min(n);
@@ -910,7 +947,7 @@ fn step_sheet(s: &mut Session, dir: i64) -> Result<Json> {
 }
 
 /// Where a range of the edited sheet goes after a structural edit (`None` = deleted).
-fn map_range(r: RangeRef, e: &Edit) -> Option<RangeRef> {
+pub(crate) fn map_range(r: RangeRef, e: &Edit) -> Option<RangeRef> {
     let expr = gridcraft_formula::Expr::Ref(gridcraft_formula::Reference {
         sheet: gridcraft_formula::SheetSel::Current,
         kind: gridcraft_formula::RefKind::Range(
@@ -942,9 +979,16 @@ fn shift_cell_features(sh: &mut Sheet, e: &Edit) {
     }
     sh.validations.retain(|dv| !dv.ranges.is_empty());
     for t in sh.tables.iter_mut() {
+        // Cells inserted or deleted across a table's full height add or remove table columns.
+        if let Edit::InsertCells { axis: Axis::Cols, range } | Edit::DeleteCells { axis: Axis::Cols, range } = *e
+            && range.start.row <= t.range.start.row
+            && range.end.row >= t.range.end.row
+        {
+            shift_table_columns(t, range.start.col, range.width(), matches!(e, Edit::InsertCells { .. }));
+        }
         t.range = map_range(t.range, e).unwrap_or_default();
     }
-    sh.tables.retain(|t| t.range != RangeRef::default());
+    sh.tables.retain(|t| t.range != RangeRef::default() && !t.columns.is_empty());
     if let Some(af) = sh.autofilter.as_mut() {
         match map_range(af.range, e) {
             Some(r) => af.range = r,
@@ -964,3 +1008,71 @@ fn shift_cell_features(sh: &mut Sheet, e: &Edit) {
         sh.print.print_area = map_range(pa, e);
     }
 }
+
+/// Columns inserted inside a table become new table columns (with names no other column has);
+/// deleted ones leave it.
+fn shift_table_columns(t: &mut gridcraft_model::Table, at: u32, count: u32, insert: bool) {
+    if insert {
+        if at > t.range.start.col && at <= t.range.end.col {
+            let idx = (at - t.range.start.col) as usize;
+            let mut n = t.columns.len();
+            for k in 0..count as usize {
+                let name = loop {
+                    n += 1;
+                    let name = format!("Column{n}");
+                    if !t.columns.iter().any(|c| c.name.eq_ignore_ascii_case(&name)) {
+                        break name;
+                    }
+                };
+                let col = gridcraft_model::TableColumn {
+                    name,
+                    totals: Default::default(),
+                    totals_label: None,
+                    formula: None,
+                    unique_name: None,
+                    xml: None,
+                };
+                t.columns.insert((idx + k).min(t.columns.len()), col);
+            }
+        }
+        return;
+    }
+    let lo = at.max(t.range.start.col);
+    let hi = at.saturating_add(count).min(t.range.end.col + 1);
+    if hi > lo {
+        let a = (lo - t.range.start.col) as usize;
+        let b = (hi - t.range.start.col) as usize;
+        if b <= t.columns.len() {
+            t.columns.drain(a..b);
+        }
+    }
+}
+
+/// Like Excel, Insert/Delete Cells never shifts part of a table: cells shifted up or down must
+/// hold whole table columns, cells shifted left or right whole table rows, and deleting cells
+/// never takes a table's header row without the whole table.
+pub(crate) fn check_table_shift(sh: &Sheet, e: &Edit) -> Result<()> {
+    let (axis, r, delete) = match *e {
+        Edit::InsertCells { axis, range } => (axis, range, false),
+        Edit::DeleteCells { axis, range } => (axis, range, true),
+        _ => return Ok(()),
+    };
+    for t in &sh.tables {
+        let tr = t.range;
+        let ok = match axis {
+            Axis::Rows => {
+                let moves = tr.end.row >= r.start.row && tr.start.col <= r.end.col && tr.end.col >= r.start.col;
+                let header_alone = delete && t.header_row && r.start.row <= tr.start.row && r.end.row >= tr.start.row && r.end.row < tr.end.row;
+                !moves || (r.start.col <= tr.start.col && r.end.col >= tr.end.col && !header_alone)
+            }
+            Axis::Cols => {
+                let moves = tr.end.col >= r.start.col && tr.start.row <= r.end.row && tr.end.row >= r.start.row;
+                !moves || (r.start.row <= tr.start.row && r.end.row >= tr.end.row)
+            }
+        };
+        if !ok {
+            return Err(EngineError::Other("This operation isn't allowed: it would shift cells in a table on your worksheet.".into()));
+        }
+    }
+    Ok(())
+}

crates/engine/src/cmd/spelling.rs

@@ -64,7 +64,14 @@ fn known(s: &Session, w: &str) -> bool {
     false
 }
 
+/// Longest word we generate suggestions for. Candidate text grows with the square of the word length, so longer
+/// tokens (no real word is this long) get no suggestions instead of an unbounded allocation.
+const MAX_SUGGEST_LEN: usize = 64;
+
 fn edits1(w: &str) -> Vec<String> {
+    if w.chars().count() > MAX_SUGGEST_LEN {
+        return Vec::new();
+    }
     let chars: Vec<char> = w.chars().collect();
     let mut out = Vec::new();
     let letters = "abcdefghijklmnopqrstuvwxyz";
@@ -177,3 +184,16 @@ fn thesaurus(_: &mut Session, p: &Json) -> Result<Json> {
     related.truncate(20);
     Ok(json!(related))
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn edits1_is_capped_for_very_long_words() {
+        assert_eq!(edits1("helo").len(), 54 * 4 + 25);
+        assert_eq!(edits1(&"a".repeat(MAX_SUGGEST_LEN)).len(), 54 * MAX_SUGGEST_LEN + 25);
+        assert!(edits1(&"a".repeat(MAX_SUGGEST_LEN + 1)).is_empty());
+        assert!(edits1(&"a".repeat(1_000_000)).is_empty());
+    }
+}

crates/engine/src/display.rs

@@ -10,11 +10,13 @@ use gridcraft_numfmt::{Formatted, NumberFormat, format_value};
 /// Parsed number formats are cached by code.
 fn parsed(code: &str) -> NumberFormat {
     static CACHE: std::sync::LazyLock<Mutex<HashMap<String, NumberFormat>>> = std::sync::LazyLock::new(|| Mutex::new(HashMap::new()));
-    let mut m = CACHE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
-    if let Some(f) = m.get(code) {
+    let lock = || CACHE.lock().unwrap_or_else(std::sync::PoisonError::into_inner);
+    if let Some(f) = lock().get(code) {
         return f.clone();
     }
+    // Parse outside the lock, so a slow code never blocks the other threads' lookups.
     let f = NumberFormat::parse(code);
+    let mut m = lock();
     if m.len() > 4096 {
         m.clear();
     }
@@ -80,15 +82,20 @@ pub fn formula_hidden(wb: &Workbook, sheet: &Sheet, c: CellRef) -> bool {
 
 /// The text a cell shows (full precision General; the grid narrows General to fit the column).
 pub fn cell_text(wb: &Workbook, sheet: &Sheet, c: CellRef) -> String {
-    let v = sheet.value(c);
     if sheet.show_formulas
         && let Some(f) = sheet.cell(c).and_then(|x| x.formula.as_ref())
         && !formula_hidden(wb, sheet, c)
     {
         return format!("={}", f.text);
     }
+    value_text(wb, sheet, c)
+}
+
+/// A cell's value with its number format applied, independent of column width: no `#####`
+/// and no General narrowing (Save As CSV/Text writes this). Formulas give their result.
+pub fn value_text(wb: &Workbook, sheet: &Sheet, c: CellRef) -> String {
     let style = wb.styles.get(sheet.style_id(c));
-    let f = format(&v, style.num_fmt.as_str(), wb);
+    let f = format(&sheet.value(c), style.num_fmt.as_str(), wb);
     match f.fill {
         Some((_, pos)) => {
             let mut t = f.text;

crates/engine/src/fill.rs

@@ -6,6 +6,7 @@ use std::sync::Arc;
 use gridcraft_core::date::{MONTHS, WEEKDAYS, datetime_from_serial, days_in_month, serial_from_ymd};
 use gridcraft_core::{CellRef, RangeRef, Value};
 use gridcraft_model::{Cell, Formula};
+use gridcraft_numfmt::{FormatKind, NumberFormat};
 
 use crate::Result;
 use crate::cmd::Ctx;
@@ -65,21 +66,25 @@ pub fn fill(cx: &mut Ctx, sheet: usize, src: RangeRef, target: RangeRef, mode: F
                 if forward { (src.end.col + 1..=target.end.col).collect() } else { (target.start.col..src.start.col).rev().collect() };
             cols.into_iter().map(|c| CellRef::new(lane, c)).collect()
         };
+        let fmt = |c: &(CellRef, Option<Cell>)| cx.wb.styles.get(c.1.as_ref().map(|c| c.style).unwrap_or_default()).num_fmt.as_str();
         let pattern = if matches!(mode, FillMode::Series | FillMode::Alternate) {
-            let detected = Pattern::detect(
-                &src_cells,
-                &custom,
-                cx.wb.date_system,
-                cx.wb.styles.get(src_cells.first().and_then(|c| c.1.as_ref()).map(|c| c.style).unwrap_or_default()).num_fmt.as_str(),
-            );
+            let detected = Pattern::detect(&src_cells, &custom, cx.wb.date_system, src_cells.first().map(fmt).unwrap_or_default());
             if mode == FillMode::Alternate { detected.alternate(&src_cells) } else { detected }
         } else {
             Pattern::Copy
         };
+        // A source with no common pattern (`Product 1`, `On backorder`): each cell continues its
+        // own series, one step per repeat of the source.
+        let per_cell: Vec<Pattern> = if mode == FillMode::Series && matches!(pattern, Pattern::Copy) && src_cells.len() > 1 {
+            src_cells.iter().map(|c| Pattern::detect(std::slice::from_ref(c), &custom, cx.wb.date_system, fmt(c))).collect()
+        } else {
+            Vec::new()
+        };
         for (k, t) in targets.iter().enumerate() {
             let step = k as i64 + 1;
             let idx = k % src_cells.len().max(1);
-            let (sc, scell) = src_cells.get(if forward { idx } else { src_cells.len() - 1 - idx }).cloned().unwrap_or((src.start, None));
+            let src_i = if forward { idx } else { src_cells.len() - 1 - idx };
+            let (sc, scell) = src_cells.get(src_i).cloned().unwrap_or((src.start, None));
             let mut cell = scell.clone().unwrap_or_default();
             match mode {
                 FillMode::Formats => {
@@ -96,7 +101,10 @@ pub fn fill(cx: &mut Ctx, sheet: usize, src: RangeRef, target: RangeRef, mode: F
                             cell.formula = Some(Arc::new(Formula::from_expr(shifted)));
                             cell.value = Value::Empty;
                         }
-                    } else if let Some(v) = pattern.value(step, forward, src_cells.len()) {
+                    } else if let Some(v) = match per_cell.get(src_i) {
+                        Some(p) => p.value(k as i64 / src_cells.len() as i64 + 1, forward, 1),
+                        None => pattern.value(step, forward, src_cells.len()),
+                    } {
                         cell.value = v;
                     }
                     cell.style = style;
@@ -173,8 +181,14 @@ impl Pattern {
             let last = nums.last().copied().unwrap_or(0.0);
             let is_date = fmt.contains('d') || fmt.contains('y') || (fmt.contains('m') && !fmt.contains('h'));
             if nums.len() == 1 {
-                // A single number copies; a single date increments by a day.
-                return if is_date { Pattern::Linear { last, first, step: 1.0 } } else { Pattern::Copy };
+                // A single number copies; a single date increments by a day, a single time by an hour.
+                return if is_date {
+                    Pattern::Linear { last, first, step: 1.0 }
+                } else if NumberFormat::parse(fmt).kind() == FormatKind::Time {
+                    Pattern::Linear { last, first, step: 1.0 / 24.0 }
+                } else {
+                    Pattern::Copy
+                };
             }
             // Dates that differ by whole months.
             if is_date && nums.len() >= 2 {
@@ -260,8 +274,12 @@ impl Pattern {
             Pattern::TextNum { prefix, suffix, last, first, step, width } => {
                 let base = if forward { *last } else { *first };
                 let n = base + step * k * sign;
-                let n = n.abs();
-                Some(Value::text(format!("{prefix}{n:0width$}{suffix}", width = *width)))
+                // `Qtr3`, `Quarter 3` wrap after 4 like `Q3`.
+                let quarter = suffix.is_empty()
+                    && (1..=4).contains(&base)
+                    && ["q", "qtr", "quarter"].contains(&prefix.trim_end().to_ascii_lowercase().as_str());
+                let n = if quarter { (n - 1).rem_euclid(4) + 1 } else { n.abs() };
+                Some(Value::text(format!("{prefix}{n:0width$}{}", ordinal_suffix(n, suffix), width = *width)))
             }
             Pattern::List { list, last, first, step, upper, lower } => {
                 let len = list.len() as i64;
@@ -309,6 +327,23 @@ fn round15(x: f64) -> f64 {
     if !p.is_finite() || p == 0.0 { x } else { (x * p).round() / p }
 }
 
+/// `1st Period` → `2nd Period`: an English ordinal ending is rewritten to suit the new number.
+fn ordinal_suffix(n: i64, suffix: &str) -> String {
+    let (Some(end), Some(rest)) = (suffix.get(..2), suffix.get(2..)) else { return suffix.to_string() };
+    if !["st", "nd", "rd", "th"].contains(&end.to_ascii_lowercase().as_str()) || rest.starts_with(char::is_alphanumeric) {
+        return suffix.to_string();
+    }
+    let new = match (n % 10, n % 100) {
+        (_, 11..=13) => "th",
+        (1, _) => "st",
+        (2, _) => "nd",
+        (3, _) => "rd",
+        _ => "th",
+    };
+    let new = if end.chars().all(|c| c.is_ascii_uppercase()) { new.to_ascii_uppercase() } else { new.to_string() };
+    format!("{new}{rest}")
+}
+
 /// `Item 007` → ("Item ", 7, "", 3); `3rd` style leading numbers → ("", 3, "rd", 1).
 fn split_num(t: &str) -> Option<(String, i64, String, usize)> {
     let chars: Vec<char> = t.chars().collect();
@@ -338,6 +373,7 @@ pub fn series(cx: &mut Ctx, sheet: usize, r: RangeRef, rows: bool, kind: &str, s
         let style = sh.style_id(first_cell);
         let mut v = start;
         for i in 1..len {
+            let prev = v;
             v = match kind {
                 "growth" => v * step,
                 "date" => {
@@ -350,7 +386,10 @@ pub fn series(cx: &mut Ctx, sheet: usize, r: RangeRef, rows: bool, kind: &str, s
                             let mut left = step.abs() as i64;
                             while left > 0 {
                                 n += step.signum();
-                                if datetime_from_serial(sys, n).is_some_and(|d| d.weekday != 0 && d.weekday != 6) {
+                                let Some(day) = datetime_from_serial(sys, n) else {
+                                    return Err(crate::EngineError::Other("The weekday series runs past the supported date range.".into()));
+                                };
+                                if day.weekday != 0 && day.weekday != 6 {
                                     left -= 1;
                                 }
                             }
@@ -361,8 +400,9 @@ pub fn series(cx: &mut Ctx, sheet: usize, r: RangeRef, rows: bool, kind: &str, s
                 }
                 _ => v + step,
             };
+            // The stop value bounds the series in the direction it runs (a growth by 0.5 falls).
             if let Some(s) = stop
-                && ((step >= 0.0 && v > s) || (step < 0.0 && v < s))
+                && ((v >= prev && v > s) || (v < prev && v < s))
             {
                 break;
             }
@@ -579,4 +619,37 @@ mod tests {
         assert_eq!(split_num("Q003x"), Some(("Q".into(), 3, "x".into(), 3)));
         assert_eq!(split_num("abc"), None);
     }
+
+    #[test]
+    fn times_quarters_ordinals_and_mixed_sources() {
+        let mut s = crate::Session::new();
+        s.new_workbook();
+        let mut fill = |values: serde_json::Value, source: &str, target: &str| {
+            s.execute("range.setValues", serde_json::json!({"range": source.get(..2).unwrap(), "values": values})).unwrap();
+            s.execute("edit.autoFill", serde_json::json!({"source": source, "target": target})).unwrap();
+            let sh = s.doc().unwrap().wb.active().unwrap();
+            let r = RangeRef::parse(target).unwrap();
+            r.iter().map(|c| crate::display::cell_text(&s.doc().unwrap().wb, sh, c)).collect::<Vec<_>>()
+        };
+        assert_eq!(fill(serde_json::json!([["9:00"]]), "A1", "A1:A3"), ["9:00", "10:00", "11:00"]);
+        assert_eq!(fill(serde_json::json!([["Qtr3"]]), "B1", "B1:B3"), ["Qtr3", "Qtr4", "Qtr1"]);
+        assert_eq!(fill(serde_json::json!([["Quarter 4"]]), "C1", "C1:C2"), ["Quarter 4", "Quarter 1"]);
+        assert_eq!(fill(serde_json::json!([["1st Period"]]), "D1", "D1:D4"), ["1st Period", "2nd Period", "3rd Period", "4th Period"]);
+        assert_eq!(
+            fill(serde_json::json!([["Product 1"], ["On backorder"]]), "E1:E2", "E1:E6"),
+            ["Product 1", "On backorder", "Product 2", "On backorder", "Product 3", "On backorder"]
+        );
+    }
+
+    #[test]
+    fn falling_growth_series_stops_at_its_stop_value() {
+        let mut s = crate::Session::new();
+        s.new_workbook();
+        s.execute("cell.set", serde_json::json!({"cell": "A1", "input": "5"})).unwrap();
+        s.execute("edit.fillSeries", serde_json::json!({"range": "A1:A6", "type": "growth", "step": 0.5, "stop": 1})).unwrap();
+        let d = s.doc().unwrap();
+        let sh = d.wb.active().unwrap();
+        let growth: Vec<String> = (1..6).map(|r| crate::display::cell_text(&d.wb, sh, CellRef::new(r, 0))).collect();
+        assert_eq!(growth, ["2.5", "1.25", "", "", ""]);
+    }
 }

crates/engine/src/io.rs

@@ -38,16 +38,83 @@ impl FileKind {
     }
 }
 
+/// The error for an encrypted workbook opened without a password contains this. The interface
+/// asks for the password when it sees it; programmatic callers pass `password` instead.
+pub const PASSWORD_REQUIRED: &str = "is password-protected. Enter its password to open it.";
+/// The error for a wrong password contains this.
+pub const WRONG_PASSWORD: &str = "The password is incorrect.";
+/// The first open warning of a workbook decrypted with its password.
+pub const DECRYPTED_NOTICE: &str = "This workbook was password-protected. GridCraft saves it without the password.";
+
 /// Parses a file's bytes into a workbook. `name` picks the format by extension when the bytes
-/// don't say.
+/// don't say. An encrypted workbook needs [`open_bytes_with_password`].
 pub fn open_bytes(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
+    open_bytes_with_password(name, bytes, None)
+}
+
+/// [`open_bytes`], first decrypting a password-protected workbook with `password`. Errors never
+/// quote the password.
+pub fn open_bytes_with_password(name: &str, bytes: &[u8], password: Option<&str>) -> Result<(Workbook, Vec<String>)> {
+    if gridcraft_xlsx::sniff(bytes) != gridcraft_xlsx::Format::Encrypted {
+        let (mut wb, warnings) = open_plain(name, bytes)?;
+        fit_imported_rows(&mut wb);
+        return Ok((wb, warnings));
+    }
+    // A scheme no password opens is said straight away, rather than after asking for one.
+    let decrypt_error = |e: gridcraft_xlsx::DecryptError| EngineError::Other(decrypt_message(name, e));
+    let Some(password) = password else {
+        gridcraft_xlsx::check_encryption(bytes).map_err(decrypt_error)?;
+        return Err(EngineError::Other(format!("'{name}' {PASSWORD_REQUIRED}")));
+    };
+    let plain = gridcraft_xlsx::decrypt(bytes, password).map_err(decrypt_error)?;
+    if gridcraft_xlsx::sniff(&plain) == gridcraft_xlsx::Format::Encrypted {
+        return Err(EngineError::Other(format!("We can't open '{name}': the encrypted file is damaged (it holds another encrypted file).")));
+    }
+    let (mut wb, mut warnings) = open_plain(name, &plain)?;
+    fit_imported_rows(&mut wb);
+    warnings.insert(0, DECRYPTED_NOTICE.into());
+    Ok((wb, warnings))
+}
+
+/// Excel auto-fits rows to their tallest font when opening a file: rows without a user-set
+/// height grow to fit their content. Rows the file made taller keep their height — our
+/// line-height estimate can differ from Excel's, and shrinking files that already look
+/// right would be a visible regression. Custom-height rows are left alone entirely.
+fn fit_imported_rows(wb: &mut Workbook) {
+    for si in 0..wb.sheets.len() {
+        let Some(sh) = wb.sheet(si) else { continue };
+        let mut rows: Vec<u32> = sh.cells.iter().map(|(c, _)| c.row).collect();
+        rows.sort_unstable();
+        rows.dedup();
+        for row in rows {
+            let before = wb.sheet(si).and_then(|sh| sh.rows.get(&row)).and_then(|i| i.size);
+            crate::cmd::auto_row_height(wb, si, row);
+            let Some(before) = before else { continue };
+            let after = wb.sheet(si).and_then(|sh| sh.rows.get(&row)).and_then(|i| i.size);
+            if after.is_none_or(|a| before > a + 0.5)
+                && let Some(sh) = wb.sheet_mut(si)
+            {
+                sh.rows.entry(row).or_default().size = Some(before);
+            }
+        }
+    }
+}
+
+/// What to tell the user when an encrypted workbook can't be decrypted. Never quotes the password.
+fn decrypt_message(name: &str, e: gridcraft_xlsx::DecryptError) -> String {
+    match e {
+        gridcraft_xlsx::DecryptError::WrongPassword => format!("{WRONG_PASSWORD} Check that Caps Lock is off and try again."),
+        gridcraft_xlsx::DecryptError::Unsupported(scheme) => {
+            format!("'{name}' uses {scheme} encryption, which GridCraft can't open yet. Remove the password in Excel and try again.")
+        }
+        gridcraft_xlsx::DecryptError::Malformed(detail) => format!("We can't open '{name}': the encrypted file is damaged ({detail})."),
+    }
+}
+
+/// Parses bytes that aren't encrypted.
+fn open_plain(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
     let kind = FileKind::from_path(name);
     let sniffed = gridcraft_xlsx::sniff(bytes);
-    if sniffed == gridcraft_xlsx::Format::Encrypted {
-        return Err(EngineError::Other(format!(
-            "'{name}' is password-protected. GridCraft can't open encrypted workbooks yet; remove the password in Excel and try again."
-        )));
-    }
     if sniffed == gridcraft_xlsx::Format::Xls {
         let (wb, report) = gridcraft_xlsx::read_xls(bytes).map_err(|e| EngineError::Other(format!("We can't open '{name}': {e}")))?;
         return Ok((wb, report.warnings));
@@ -62,6 +129,8 @@ pub fn open_bytes(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
     let import = match sniffed {
         gridcraft_xlsx::Format::Ods => Some(FileKind::Ods),
         gridcraft_xlsx::Format::Xlsb => Some(FileKind::Xlsb),
+        // An XLSX package is never read as ODS/XLSB just because of its name.
+        gridcraft_xlsx::Format::Xlsx => None,
         _ => kind.filter(|k| matches!(k, FileKind::Ods | FileKind::Xlsb)),
     };
     if let Some(import) = import {
@@ -69,7 +138,8 @@ pub fn open_bytes(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
         let (wb, report) = read(bytes).map_err(|e| EngineError::Other(format!("We can't import '{name}': {e}")))?;
         return Ok((wb, report.warnings));
     }
-    if sniffed == gridcraft_xlsx::Format::Xlsx || kind == Some(FileKind::Xlsx) {
+    // Text named `.xlsx` is read as text.
+    if sniffed == gridcraft_xlsx::Format::Xlsx || (kind == Some(FileKind::Xlsx) && sniffed != gridcraft_xlsx::Format::Csv) {
         let (wb, report) = gridcraft_xlsx::read_xlsx(bytes).map_err(|e| EngineError::Other(format!("We can't open '{name}': {e}")))?;
         return Ok((wb, report.warnings));
     }
@@ -85,6 +155,8 @@ pub fn open_bytes(name: &str, bytes: &[u8]) -> Result<(Workbook, Vec<String>)> {
         Some(FileKind::Tsv) => {
             let opts = gridcraft_xlsx::CsvOptions { delimiter: b'\t', ..Default::default() };
             let mut wb = gridcraft_xlsx::read_csv(bytes, &opts).map_err(|e| EngineError::Other(e.to_string()))?;
+            // Tab is what makes it a .tsv/.txt; saved as .csv it gets the CSV default.
+            wb.csv_delimiter = None;
             rename_first_sheet(&mut wb, name);
             Ok((wb, vec![]))
         }
@@ -102,7 +174,9 @@ fn rename_first_sheet(wb: &mut Workbook, path: &str) {
     let stem = std::path::Path::new(path).file_stem().and_then(|s| s.to_str()).unwrap_or("Sheet1");
     let clean: String = stem.chars().filter(|c| !matches!(c, ':' | '\\' | '/' | '?' | '*' | '[' | ']')).take(31).collect();
     let clean = clean.trim_matches('\'').to_string();
+    // "History" is reserved (see `Workbook::check_sheet_name`): keep the default name instead.
     if !clean.is_empty()
+        && !clean.eq_ignore_ascii_case("History")
         && let Some(sh) = wb.sheet_mut(0)
     {
         sh.name = clean;
@@ -111,28 +185,68 @@ fn rename_first_sheet(wb: &mut Workbook, path: &str) {
 
 /// Encodes a workbook in the format chosen by `path`'s extension.
 pub fn save_bytes(wb: &Workbook, path: &str) -> Result<Vec<u8>> {
+    // An unknown or missing extension is refused rather than written as an XLSX under that name:
+    // a typo like `.cvs` would otherwise produce a file no other app recognises.
+    let Some(kind) = FileKind::from_path(path) else {
+        let name = std::path::Path::new(path).file_name().and_then(|n| n.to_str()).unwrap_or(path);
+        return Err(EngineError::Other(format!("{name}: unknown file format. Save as .xlsx, .csv, .tsv, .json or .html.")));
+    };
+    save_bytes_as(wb, path, kind)
+}
+
+/// Encodes a workbook as `kind`, whatever `path`'s extension says.
+pub fn save_bytes_as(wb: &Workbook, path: &str, kind: FileKind) -> Result<Vec<u8>> {
     let sheet = wb.active_sheet;
-    match FileKind::from_path(path).unwrap_or(FileKind::Xlsx) {
-        // A macro-free .xlsx can't hold a VBA project (Excel refuses such a file), so only a .xlsm
-        // keeps the macros; any other name saves without them, as Excel does.
-        FileKind::Xlsx if wb.vba_project.is_some() && !path.to_ascii_lowercase().ends_with(".xlsm") => {
-            let mut plain = wb.clone();
-            plain.vba_project = None;
-            gridcraft_xlsx::write_xlsx(&plain).map_err(|e| EngineError::Other(e.to_string()))
-        }
-        FileKind::Xlsx => gridcraft_xlsx::write_xlsx(wb).map_err(|e| EngineError::Other(e.to_string())),
+    match kind {
+        // The extension picks the package kind; only the macro-enabled kinds (.xlsm, .xltm) carry
+        // the VBA project, so any other name saves without it, as Excel does.
+        FileKind::Xlsx => gridcraft_xlsx::write_xlsx_as(wb, gridcraft_xlsx::XlsxKind::from_path(path)).map_err(|e| EngineError::Other(e.to_string())),
         FileKind::Xls => {
             Err(EngineError::Other("Excel 97-2003 (.xls) is supported for import only. Save as .xlsx or another supported export format.".into()))
         }
         FileKind::Xlsb => Err(EngineError::Other("XLSB is supported for data import only. Save as .xlsx or another supported export format.".into())),
         FileKind::Ods => Err(EngineError::Other("ODS is supported for data import only. Save as .xlsx or another supported export format.".into())),
-        FileKind::Csv => Ok(wb.sheet(sheet).map(|sh| gridcraft_xlsx::write_csv(sh, wb, b',')).unwrap_or_default()),
-        FileKind::Tsv => Ok(wb.sheet(sheet).map(|sh| gridcraft_xlsx::write_csv(sh, wb, b'\t')).unwrap_or_default()),
+        // A workbook read from CSV keeps the separator it was read with (a `;` file stays `;`).
+        FileKind::Csv => wb.sheet(sheet).map(|sh| csv(wb, sh, wb.csv_delimiter.unwrap_or(b','))).transpose().map(Option::unwrap_or_default),
+        FileKind::Tsv => wb.sheet(sheet).map(|sh| csv(wb, sh, b'\t')).transpose().map(Option::unwrap_or_default),
         FileKind::Json => serde_json::to_vec_pretty(wb).map_err(|e| EngineError::Other(e.to_string())),
-        FileKind::Html => Ok(to_html(wb, sheet).into_bytes()),
+        FileKind::Html => to_html(wb, sheet).map(String::into_bytes),
     }
 }
 
+/// [`save_bytes`] for the file at `path`: relative paths to linked workbooks are rewritten for
+/// its folder, so they still name the same files.
+pub fn save_file_bytes(wb: &Workbook, path: &str) -> Result<Vec<u8>> {
+    match source_dir(path).and_then(|f| gridcraft_xlsx::rebase_links(wb, &f)) {
+        Some(rebased) => save_bytes(&rebased, path),
+        None => save_bytes(wb, path),
+    }
+}
+
+/// The folder of the file at `path`, which relative paths to linked workbooks are relative to.
+pub fn source_dir(path: &str) -> Option<std::path::PathBuf> {
+    std::path::absolute(path).ok()?.parent().map(std::path::Path::to_path_buf)
+}
+
+/// Save As CSV/Text writes "the text and values as they are displayed in cells" with "all
+/// characters in each cell" (Microsoft Support, *Excel formatting and features that are not
+/// transferred to other file formats*): number formats applied, never column-width `#####`.
+fn csv(wb: &Workbook, sh: &Sheet, delimiter: u8) -> Result<Vec<u8>> {
+    gridcraft_xlsx::write_csv(sh, delimiter, |c| {
+        // General's grid-width formatting rounds large identifiers to scientific notation.
+        // Delimited files have no column width, so preserve the whole numeric value instead.
+        if wb.styles.get(sh.style_id(c)).num_fmt.as_str().eq_ignore_ascii_case("General")
+            && let gridcraft_core::Value::Number(number) = sh.value(c)
+            && number.is_finite()
+        {
+            number.to_string()
+        } else {
+            crate::display::value_text(wb, sh, c)
+        }
+    })
+    .map_err(|e| EngineError::Other(e.to_string()))
+}
+
 fn esc(s: &str) -> String {
     s.replace('&', "&amp;").replace('<', "&lt;").replace('>', "&gt;").replace('"', "&quot;")
 }
@@ -240,9 +354,12 @@ impl std::fmt::Write for ClipboardHtml {
     }
 }
 
+/// Most rows Save as Web Page writes. A sheet whose used range is taller fails instead of losing cells.
+const HTML_EXPORT_MAX_ROWS: u32 = 100_001;
+
 /// A sheet as a standalone HTML table (Save as Web Page).
-pub fn to_html(wb: &Workbook, sheet: usize) -> String {
-    let Some(sh) = wb.sheet(sheet) else { return String::new() };
+pub fn to_html(wb: &Workbook, sheet: usize) -> Result<String> {
+    let Some(sh) = wb.sheet(sheet) else { return Ok(String::new()) };
     let mut out = String::new();
     let _ = write!(
         out,
@@ -250,7 +367,13 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> String {
         esc(&sh.name)
     );
     if let Some(r) = sh.used_range() {
-        for row in r.start.row..=r.end.row.min(r.start.row + 100_000) {
+        if r.height() > HTML_EXPORT_MAX_ROWS {
+            return Err(EngineError::Other(format!(
+                "the sheet is too tall for a web page ({} rows, at most {HTML_EXPORT_MAX_ROWS}). Save as .xlsx or CSV instead.",
+                r.height()
+            )));
+        }
+        for row in r.start.row..=r.end.row {
             if sh.is_row_hidden(row) {
                 continue;
             }
@@ -273,7 +396,7 @@ pub fn to_html(wb: &Workbook, sheet: usize) -> String {
         }
     }
     out.push_str("</table></body></html>");
-    out
+    Ok(out)
 }
 
 #[cfg(not(target_arch = "wasm32"))]
@@ -294,8 +417,12 @@ pub fn read_file(path: &str) -> Result<Vec<u8>> {
 pub fn write_file(path: &str, bytes: &[u8]) -> Result<()> {
     // Write to a temporary file, then rename: a crash never leaves a half-written workbook.
     let tmp = format!("{path}.sctmp");
-    std::fs::write(&tmp, bytes).map_err(|e| EngineError::Other(format!("{path}: {e}")))?;
-    std::fs::rename(&tmp, path).map_err(|e| EngineError::Other(format!("{path}: {e}")))
+    std::fs::write(&tmp, bytes).and_then(|()| std::fs::rename(&tmp, path)).map_err(|e| {
+        // A write or rename that fails (full disk, the workbook locked by another app) leaves
+        // no temporary file beside the user's workbook.
+        let _ = std::fs::remove_file(&tmp);
+        EngineError::Other(format!("{path}: {e}"))
+    })
 }
 
 #[cfg(target_arch = "wasm32")]
@@ -373,6 +500,20 @@ pub fn image_size(data: &[u8]) -> Option<(u32, u32)> {
 mod tests {
     use super::*;
 
+    #[test]
+    fn html_export_fails_instead_of_dropping_cells_past_the_row_limit() {
+        let mut wb = Workbook::new();
+        let sh = wb.sheet_mut(0).unwrap();
+        sh.set_value(CellRef::new(0, 0), gridcraft_core::Value::text("near"));
+        sh.set_value(CellRef::new(149_999, 0), gridcraft_core::Value::text("far"));
+        assert!(save_bytes(&wb, "book.html").is_err());
+        let sh = wb.sheet_mut(0).unwrap();
+        sh.remove_cell(CellRef::new(149_999, 0));
+        sh.set_value(CellRef::new(100_000, 0), gridcraft_core::Value::text("far"));
+        let html = String::from_utf8(save_bytes(&wb, "book.html").unwrap()).unwrap();
+        assert!(html.contains(">near</td>") && html.contains(">far</td>"));
+    }
+
     #[test]
     fn macros_are_saved_only_into_xlsm() {
         let mut wb = Workbook::new();
@@ -384,9 +525,42 @@ mod tests {
         assert!(has_macros("book.xlsm"));
         assert!(has_macros("BOOK.XLSM"));
         assert!(!has_macros("book.xlsx"), "an .xlsx never carries a VBA project");
+        assert!(has_macros("book.xltm"), "a macro-enabled template keeps the VBA project");
+        assert!(!has_macros("book.xltx"), "a macro-free template never carries a VBA project");
         assert!(wb.vba_project.is_some(), "the open workbook keeps its macros");
     }
 
+    #[test]
+    fn csv_named_history_does_not_get_the_reserved_sheet_name() {
+        for file in ["History.csv", "hIsToRy.csv", "history.tsv"] {
+            let (wb, _) = open_bytes(file, b"1\n").unwrap();
+            let name = wb.sheets[0].name.clone();
+            assert!(wb.check_sheet_name(&name, Some(0)).is_ok(), "{file} opened as {name:?}");
+        }
+        let (wb, _) = open_bytes("Sales.csv", b"1\n").unwrap();
+        assert_eq!(wb.sheets[0].name, "Sales");
+    }
+
+    /// A save that can't be put in place (here a folder already has the workbook's name, as
+    /// with a file another app holds locked) fails without leaving `<name>.sctmp` behind.
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn failed_save_leaves_no_temporary_file() {
+        let dir = std::env::temp_dir().join(format!("gridcraft-write-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&dir);
+        std::fs::create_dir_all(&dir).unwrap();
+        let blocked = dir.join("Book1.xlsx");
+        std::fs::create_dir(&blocked).unwrap();
+        assert!(write_file(blocked.to_str().unwrap(), b"workbook").is_err());
+        assert!(!dir.join("Book1.xlsx.sctmp").exists(), "the temporary file is removed");
+        // An ordinary save still works and leaves only the workbook.
+        let ok = dir.join("Book2.xlsx");
+        write_file(ok.to_str().unwrap(), b"workbook").unwrap();
+        assert_eq!(std::fs::read(&ok).unwrap(), b"workbook");
+        assert!(!dir.join("Book2.xlsx.sctmp").exists());
+        let _ = std::fs::remove_dir_all(&dir);
+    }
+
     /// A minimal compound (CFB/OLE2) file — FAT in sector 0, directory in sector 1 — holding a
     /// root entry and the given stream names.
     fn cfb(streams: &[&str]) -> Vec<u8> {
@@ -410,12 +584,71 @@ mod tests {
         b
     }
 
+    /// Cut-list rows as a CAD/CAM program exports them: `;`-separated, CRLF, part codes in the last
+    /// two columns, a part name containing a comma.
+    const CUT_LIST: &str = "1;511;184;P3_L1_led;2162PE;16;1MM_2162PE;1MM_2162PE;;;1244121406FB;\r\n\
+                            1;562.5;510;Komoda, lijevo;2162PE;19;1MM_2162PE;;;;12441214071A;124412140710\r\n";
+
+    #[test]
+    fn csv_save_keeps_the_separator_it_was_opened_with() {
+        let (wb, _) = open_bytes("cut list.csv", CUT_LIST.as_bytes()).unwrap();
+        assert_eq!(wb.csv_delimiter, Some(b';'));
+        assert_eq!(String::from_utf8(save_bytes(&wb, "cut list.csv").unwrap()).unwrap(), CUT_LIST);
+        // Save As another .csv name keeps it too; a comma file stays a comma file (quoting only
+        // fields that contain the separator in use).
+        assert_eq!(String::from_utf8(save_bytes(&wb, "copy.CSV").unwrap()).unwrap(), CUT_LIST);
+        let commas = "\"Komoda, lijevo\",b\r\n1,x;y\r\n";
+        let (wb, _) = open_bytes("plain.csv", commas.as_bytes()).unwrap();
+        assert_eq!(String::from_utf8(save_bytes(&wb, "plain.csv").unwrap()).unwrap(), commas);
+        // A tab-separated file named .csv round-trips with tabs.
+        let tabs = "a\tb\r\n1\t2\r\n";
+        let (wb, _) = open_bytes("tabs.csv", tabs.as_bytes()).unwrap();
+        assert_eq!(String::from_utf8(save_bytes(&wb, "tabs.csv").unwrap()).unwrap(), tabs);
+    }
+
+    #[test]
+    fn csv_save_of_a_workbook_not_read_from_csv_uses_commas() {
+        let mut wb = Workbook::new();
+        if let Some(sh) = wb.sheet_mut(0) {
+            sh.set_value(CellRef::new(0, 0), gridcraft_core::Value::text("a"));
+            sh.set_value(CellRef::new(0, 1), gridcraft_core::Value::Number(1.0));
+        }
+        assert_eq!(save_bytes(&wb, "new.csv").unwrap(), b"a,1\r\n");
+        // Through .xlsx the CSV origin is gone, as in Excel.
+        let (from_csv, _) = open_bytes("cut list.csv", CUT_LIST.as_bytes()).unwrap();
+        let (reopened, _) = open_bytes("book.xlsx", &save_bytes(&from_csv, "book.xlsx").unwrap()).unwrap();
+        assert_eq!(reopened.csv_delimiter, None);
+        assert!(String::from_utf8(save_bytes(&reopened, "again.csv").unwrap()).unwrap().starts_with("1,511,184,"));
+        // A .tsv/.txt saved as .csv gets commas; as .tsv it keeps tabs.
+        let (tsv, _) = open_bytes("list.txt", b"a\tb\r\n").unwrap();
+        assert_eq!(save_bytes(&tsv, "list.csv").unwrap(), b"a,b\r\n");
+        assert_eq!(save_bytes(&tsv, "list.tsv").unwrap(), b"a\tb\r\n");
+    }
+
     #[test]
     fn encrypted_workbook_is_reported_not_misread() {
-        let err = open_bytes("secret.xlsx", &cfb(&["EncryptionInfo", "EncryptedPackage"])).unwrap_err();
-        let msg = err.to_string();
-        assert!(msg.contains("password-protected"), "got: {msg}");
+        let file = gridcraft_xlsx::testing::encrypt_workbook(b"package", "pw");
+        let msg = open_bytes("secret.xlsx", &file).unwrap_err().to_string();
+        assert!(msg.contains(PASSWORD_REQUIRED), "got: {msg}");
         assert!(!msg.contains("zip"), "must not surface the zip error: {msg}");
+        // A compound file naming the streams but unreadable is damage: no password is asked for,
+        // and none helps.
+        let file = cfb(&["EncryptionInfo", "EncryptedPackage"]);
+        for password in [None, Some("pw")] {
+            let msg = open_bytes_with_password("secret.xlsx", &file, password).unwrap_err().to_string();
+            assert!(msg.contains("damaged") && !msg.contains(PASSWORD_REQUIRED), "got: {msg}");
+        }
+    }
+
+    #[test]
+    fn encryption_no_password_opens_is_reported_without_asking_for_one() {
+        let info: &[u8] = &[3, 0, 2, 0, 4, 0, 0, 0]; // Standard header flags: RC4, not AES
+        let file = gridcraft_xlsx::testing::compound_file(&[("EncryptionInfo", info), ("EncryptedPackage", &[0; 8])]);
+        let msg = open_bytes("rc4.xlsx", &file).unwrap_err().to_string();
+        assert!(msg.contains("RC4") && !msg.contains(PASSWORD_REQUIRED), "got: {msg}");
+        let irm = gridcraft_xlsx::testing::compound_file(&[("EncryptedPackage", &[0; 8])]);
+        let msg = open_bytes("irm.xlsx", &irm).unwrap_err().to_string();
+        assert!(msg.contains("rights-management") && !msg.contains("damaged"), "got: {msg}");
     }
 
     #[test]
@@ -425,4 +658,85 @@ mod tests {
         assert!(msg.contains("not an Excel workbook"), "got: {msg}");
         assert!(!msg.contains("password"), "got: {msg}");
     }
+
+    /// Save As CSV/TSV writes cells as displayed: number formats applied, formula results,
+    /// whole values in narrow columns (never `#####`), quoting unchanged.
+    #[test]
+    fn csv_writes_displayed_text() {
+        use gridcraft_core::{CellError, Value};
+        use gridcraft_model::{Cell, Formula, LineInfo, NumFmt, StyleId};
+        let mut wb = Workbook::new();
+        let mut styled = |code: &str| wb.styles.derive(StyleId::DEFAULT, |s| s.num_fmt = NumFmt::new(code));
+        let (date, money, pct, frac, text, fixed, thousands) =
+            (styled("yyyy-mm-dd"), styled("$#,##0.00"), styled("0.0%"), styled("# ?/?"), styled("@"), styled("0.00"), styled("#,##0"));
+        let sh = wb.sheet_mut(0).unwrap();
+        let cells = [
+            ("A1", Cell { value: Value::Number(46023.0), formula: None, style: date }),
+            ("B1", Cell { value: Value::Number(1234.5), formula: None, style: money }),
+            ("C1", Cell { value: Value::Number(0.125), formula: None, style: pct }),
+            ("D1", Cell { value: Value::Number(1.5), formula: None, style: frac }),
+            ("E1", Cell { value: Value::text("007"), formula: None, style: text }),
+            ("F1", Cell { value: Value::Error(CellError::NA), formula: None, style: money }),
+            ("G1", Cell { value: Value::Bool(true), formula: None, style: StyleId::DEFAULT }),
+            ("A2", Cell { value: Value::Number(46024.0), style: date, ..Cell::formula(Formula::new("A1+1")) }),
+            ("B2", Cell { value: Value::Number(12345678.9), formula: None, style: fixed }),
+            ("C2", Cell { value: Value::Number(-0.25), formula: None, style: StyleId::DEFAULT }),
+            ("D2", Cell { value: Value::Number(1234567.0), formula: None, style: thousands }),
+        ];
+        for (a, c) in cells {
+            sh.set_cell(CellRef::parse(a).unwrap(), c);
+        }
+        // Column B is far too narrow for its numbers: the grid shows #####, the file must not.
+        sh.cols.insert(1, LineInfo { size: Some(1.0), ..Default::default() });
+        sh.show_formulas = true;
+        let csv = String::from_utf8(save_bytes(&wb, "out.csv").unwrap()).unwrap();
+        assert_eq!(csv, "2026-01-01,\"$1,234.50\",12.5%,1 1/2,007,#N/A,TRUE\r\n2026-01-02,12345678.90,-0.25,\"1,234,567\",,,\r\n");
+        let tsv = String::from_utf8(save_bytes(&wb, "out.tsv").unwrap()).unwrap();
+        assert!(tsv.starts_with("2026-01-01\t$1,234.50\t12.5%\t"), "{tsv}");
+    }
+
+    #[test]
+    fn delimited_exports_preserve_general_precision_and_explicit_number_formats() {
+        use gridcraft_core::Value;
+        use gridcraft_model::{Cell, NumFmt, StyleId};
+        let mut workbook = Workbook::new();
+        let scientific = workbook.styles.derive(StyleId::DEFAULT, |style| style.num_fmt = NumFmt::new("0.00E+00"));
+        let sheet = workbook.sheet_mut(0).unwrap();
+        sheet.set_cell(CellRef::new(0, 0), Cell { value: Value::Number(124412140710.0), ..Default::default() });
+        sheet.set_cell(CellRef::new(0, 1), Cell { value: Value::Number(1.23456789012345), ..Default::default() });
+        sheet.set_cell(CellRef::new(0, 2), Cell { value: Value::Number(124412140710.0), style: scientific, ..Default::default() });
+        for (path, separator) in [("data.csv", ","), ("data.tsv", "\t")] {
+            let output = String::from_utf8(save_bytes(&workbook, path).unwrap()).unwrap();
+            assert_eq!(output, format!("124412140710{separator}1.23456789012345{separator}1.24E+11\r\n"));
+        }
+    }
+
+    #[test]
+    fn template_extension_saves_template_content_type() {
+        let bytes = save_bytes(&Workbook::new(), "Budget.xltx").unwrap();
+        let mut zip = zip::ZipArchive::new(std::io::Cursor::new(bytes)).unwrap();
+        let mut types = String::new();
+        std::io::Read::read_to_string(&mut zip.by_name("[Content_Types].xml").unwrap(), &mut types).unwrap();
+        assert!(
+            types.contains(
+                r#"PartName="/xl/workbook.xml" ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.template.main+xml""#
+            ),
+            "{types}"
+        );
+    }
+
+    #[test]
+    fn content_wins_over_a_mismatched_extension() {
+        let mut wb = Workbook::new();
+        wb.sheet_mut(0).unwrap().set_value(CellRef::new(0, 0), gridcraft_core::Value::Number(7.0));
+        let package = save_bytes(&wb, "book.xlsx").unwrap();
+        for name in ["book.xlsx", "book.ods", "book.xlsb", "book.csv"] {
+            let (opened, _) = open_bytes(name, &package).unwrap_or_else(|e| panic!("{name}: {e}"));
+            assert_eq!(opened.sheet(0).unwrap().value(CellRef::new(0, 0)), gridcraft_core::Value::Number(7.0), "{name}");
+        }
+        for name in ["data.xlsx", "data.csv"] {
+            let (opened, _) = open_bytes(name, b"a,b\n1,2\n").unwrap_or_else(|e| panic!("{name}: {e}"));
+            assert_eq!(opened.sheet(0).unwrap().value(CellRef::new(0, 1)), gridcraft_core::Value::text("b"), "{name}");
+        }
+    }
 }

crates/engine/src/lib.rs

@@ -13,6 +13,7 @@ pub mod cmd;
 pub mod display;
 pub mod fill;
 pub mod io;
+pub mod links;
 pub mod outline;
 pub mod paper;
 pub mod pivot;
@@ -29,7 +30,7 @@ use gridcraft_model::Workbook;
 use serde::Serialize;
 use serde_json::Value as Json;
 
-pub use cmd::{CommandInfo, CommandSpec, command_specs, find_command};
+pub use cmd::{CommandInfo, CommandSpec, command_specs, find_command, register_test_command};
 pub use gridcraft_calc as calc;
 pub use gridcraft_core as core;
 pub use gridcraft_formula as formula;
@@ -108,6 +109,9 @@ pub struct DocState {
     pub sheet_selections: Vec<Selection>,
     /// Allow Edit Ranges unlocked with their password in this session: (sheet name, title).
     pub unlocked_ranges: Vec<(String, String)>,
+    /// The format `path`'s content was recognised as when its extension doesn't name one (an
+    /// XLSX called `budget.dat`): Save writes it back in that format.
+    pub content_kind: Option<io::FileKind>,
 }
 
 static NEXT_UID: std::sync::atomic::AtomicU64 = std::sync::atomic::AtomicU64::new(1);
@@ -132,6 +136,7 @@ impl DocState {
             title,
             sheet_selections: vec![],
             unlocked_ranges: vec![],
+            content_kind: None,
         }
     }
     pub fn is_dirty(&self) -> bool {

crates/engine/src/links.rs

@@ -0,0 +1,83 @@
+//! Which hyperlink targets may be opened. A cell's link comes from the document (often a file
+//! somebody sent), so it is hostile input: only `http`, `https` and `mailto` ever leave the
+//! workbook for the system; `file:`, `smb:`, UNC paths, custom URL handlers, `javascript:` and
+//! the like are refused. Everything without a scheme stays an in-workbook reference.
+
+use gridcraft_core::RangeRef;
+
+/// What a link target is.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum LinkKind {
+    /// A cell, range, name or table of the workbook (`Sheet2!A1`, `Total`).
+    Internal(String),
+    /// An address to hand to the system, trimmed: `http`, `https` or `mailto` only.
+    External(String),
+    /// Refused, with the reason to show.
+    Refused(String),
+}
+
+const ALLOWED: [&str; 3] = ["http", "https", "mailto"];
+
+/// Classifies a link target. Never panics; the single place that decides what may be opened.
+pub fn classify(target: &str) -> LinkKind {
+    let t = target.trim();
+    if t.chars().any(char::is_control) {
+        return LinkKind::Refused("The link contains control characters.".into());
+    }
+    if t.starts_with("\\\\") || t.starts_with("//") {
+        return LinkKind::Refused("Links to network locations aren't opened.".into());
+    }
+    if RangeRef::parse(t).is_some() {
+        return LinkKind::Internal(t.to_string());
+    }
+    let Some((scheme, rest)) = t.split_once(':') else { return LinkKind::Internal(t.to_string()) };
+    let scheme_like = scheme.chars().next().is_some_and(|c| c.is_ascii_alphabetic())
+        && scheme.chars().all(|c| c.is_ascii_alphanumeric() || matches!(c, '+' | '-' | '.'));
+    if !scheme_like {
+        return LinkKind::Internal(t.to_string());
+    }
+    let lower = scheme.to_ascii_lowercase();
+    if ALLOWED.contains(&lower.as_str()) && !rest.trim().is_empty() {
+        LinkKind::External(t.to_string())
+    } else {
+        LinkKind::Refused(format!("Links of type \"{lower}:\" aren't opened. Only http, https and mailto links are allowed."))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_http_https_and_mailto_leave_the_workbook() {
+        for ok in ["http://a.example/x", "HTTPS://A.example", "  https://a.example  ", "MailTo:a@b.example"] {
+            assert!(matches!(classify(ok), LinkKind::External(_)), "{ok}");
+        }
+        assert_eq!(classify(" https://a.example "), LinkKind::External("https://a.example".into()));
+        for bad in [
+            "javascript:alert(1)",
+            "JaVaScRiPt:alert(1)",
+            "file:///etc/passwd",
+            "smb://host/share",
+            "ms-excel:ofe|u|http://x",
+            "\\\\host\\share\\x.exe",
+            "//host/share",
+            "C:\\Windows\\calc.exe",
+            "\tjavascript:1",
+            "java\nscript:1",
+            "\u{1}http://a.example",
+            "http:",
+            "mailto:",
+            "x-custom://a",
+        ] {
+            assert!(matches!(classify(bad), LinkKind::Refused(_)), "{bad:?} -> {:?}", classify(bad));
+        }
+    }
+
+    #[test]
+    fn references_stay_internal() {
+        for r in ["Sheet2!A1", "'My Sheet'!B2:C3", "A1:B2", "#Sheet1!A1", "Total", "", "   "] {
+            assert!(matches!(classify(r), LinkKind::Internal(_)), "{r:?} -> {:?}", classify(r));
+        }
+    }
+}

crates/engine/src/pivot.rs

@@ -560,6 +560,8 @@ struct Line {
     values: bool,
     /// (column, value, indent, number format)
     labels: Vec<(usize, Value, u8, Option<String>)>,
+    /// The value field of the line when Σ Values sits in Rows (`None`: one per data column).
+    vi: Option<usize>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -579,6 +581,10 @@ struct Ctx<'a> {
     rows: Vec<&'a PivotField>,
     row_items: Vec<FieldItems>,
     row_fmts: Vec<String>,
+    /// Depth of Σ Values among the row fields when it sits in Rows (two or more value fields).
+    vpos: Option<usize>,
+    /// Value field captions.
+    val_names: Vec<String>,
 }
 
 impl Ctx<'_> {
@@ -588,26 +594,105 @@ impl Ctx<'_> {
         (it.value.clone(), fmt, it.label.clone())
     }
 
-    fn flatten(&self, nodes: &[Node], depth: usize, prefix: &mut Vec<u32>, out: &mut Vec<Line>) {
+    /// (column, indent) of a row level (Σ Values counts as a level) in Compact/Outline form.
+    fn level_cell(&self, level: usize) -> (usize, u8) {
+        if self.pt.layout == PivotLayout::Outline { (level, 0) } else { (0, level.min(250) as u8) }
+    }
+
+    /// Σ Values comes right here, at row field depth `depth` (`vi`: the value field already chosen above).
+    fn values_here(&self, depth: usize, vi: Option<usize>) -> bool {
+        vi.is_none() && self.vpos == Some(depth)
+    }
+
+    /// Per-value subtotal lines of an item with Σ Values below it ("East Sum of Sales").
+    fn value_subtotals(&self, col: usize, indent: u8, label: &str, prefix: &[u32], out: &mut Vec<Line>) {
+        for (vi, name) in self.val_names.iter().enumerate() {
+            out.push(Line {
+                kind: LineKind::Subtotal,
+                leaf: false,
+                path: prefix.to_vec(),
+                values: true,
+                labels: vec![(col, Value::text(format!("{label} {name}")), indent, None)],
+                vi: Some(vi),
+            });
+        }
+    }
+
+    /// The Σ Values level at row field depth `depth`: one item per value field, each followed by
+    /// the row fields below it (`nodes`) or, innermost, holding that value.
+    fn flatten_values(&self, nodes: &[Node], depth: usize, prefix: &mut Vec<u32>, out: &mut Vec<Line>) {
+        let (col, indent) = self.level_cell(depth);
+        for (vi, name) in self.val_names.iter().enumerate() {
+            let labels = vec![(col, Value::text(name.as_str()), indent, None)];
+            let leaf = nodes.is_empty();
+            out.push(Line { kind: LineKind::Item(!leaf), leaf, path: prefix.clone(), values: leaf, labels, vi: Some(vi) });
+            if !leaf {
+                self.flatten(nodes, depth, Some(vi), prefix, out);
+            }
+        }
+    }
+
+    fn flatten(&self, nodes: &[Node], depth: usize, vi: Option<usize>, prefix: &mut Vec<u32>, out: &mut Vec<Line>) {
+        if self.values_here(depth, vi) {
+            self.flatten_values(nodes, depth, prefix, out);
+            return;
+        }
         let n = self.rows.len();
-        let outline = self.pt.layout == PivotLayout::Outline;
+        // Σ Values still to come below this level: totals need one line per value field.
+        let values_below = vi.is_none() && self.vpos.is_some();
+        let (col, indent) = self.level_cell(depth + usize::from(vi.is_some() && self.vpos.is_some()));
         for node in nodes {
             prefix.push(node.item);
             let (v, fmt, label) = self.label_cell(depth, node.item);
-            let (col, indent) = if outline { (depth, 0) } else { (0, depth.min(250) as u8) };
             let collapsed = depth + 1 < n && self.rows.get(depth).is_some_and(|f| is_collapsed(f, &label));
-            if depth + 1 >= n || collapsed || node.children.is_empty() {
+            let leaf = depth + 1 >= n || collapsed || node.children.is_empty();
+            if leaf && !values_below {
                 out.push(Line {
                     kind: LineKind::Item(depth + 1 < n),
                     leaf: true,
                     path: prefix.clone(),
                     values: true,
                     labels: vec![(col, v, indent, fmt)],
+                    vi,
                 });
+            } else if leaf {
+                out.push(Line {
+                    kind: LineKind::Item(true),
+                    leaf: false,
+                    path: prefix.clone(),
+                    values: false,
+                    labels: vec![(col, v, indent, fmt)],
+                    vi,
+                });
+                // Outline gives each level its own column, so the captions go in the Values
+                // column even when the levels between are collapsed away.
+                let level = if self.pt.layout == PivotLayout::Outline { self.vpos.unwrap_or(depth + 1) } else { depth + 1 };
+                self.flatten_values(&[], level, prefix, out);
+            } else if values_below {
+                // Subtotals per value field, below the group (one line can't hold them all).
+                out.push(Line {
+                    kind: LineKind::Item(true),
+                    leaf: false,
+                    path: prefix.clone(),
+                    values: false,
+                    labels: vec![(col, v, indent, fmt)],
+                    vi,
+                });
+                self.flatten(&node.children, depth + 1, None, prefix, out);
+                if self.pt.subtotals {
+                    self.value_subtotals(col, indent, &label, prefix, out);
+                }
             } else {
                 let top = self.pt.subtotals && self.pt.subtotals_top;
-                out.push(Line { kind: LineKind::Item(true), leaf: false, path: prefix.clone(), values: top, labels: vec![(col, v, indent, fmt)] });
-                self.flatten(&node.children, depth + 1, prefix, out);
+                out.push(Line {
+                    kind: LineKind::Item(true),
+                    leaf: false,
+                    path: prefix.clone(),
+                    values: top,
+                    labels: vec![(col, v, indent, fmt)],
+                    vi,
+                });
+                self.flatten(&node.children, depth + 1, vi, prefix, out);
                 if self.pt.subtotals && !self.pt.subtotals_top {
                     out.push(Line {
                         kind: LineKind::Subtotal,
@@ -615,6 +700,7 @@ impl Ctx<'_> {
                         path: prefix.clone(),
                         values: true,
                         labels: vec![(col, Value::text(format!("{label} Total")), indent, None)],
+                        vi,
                     });
                 }
             }
@@ -622,7 +708,8 @@ impl Ctx<'_> {
         }
     }
 
-    fn flatten_tabular(
+    /// Tabular form of [`Self::flatten_values`]: the first line also carries the parents' labels.
+    fn flatten_tabular_values(
         &self,
         nodes: &[Node],
         depth: usize,
@@ -630,24 +717,57 @@ impl Ctx<'_> {
         pending: &[(usize, Value, u8, Option<String>)],
         out: &mut Vec<Line>,
     ) {
+        for (vi, name) in self.val_names.iter().enumerate() {
+            let mut labels: Vec<(usize, Value, u8, Option<String>)> = if vi == 0 { pending.to_vec() } else { vec![] };
+            labels.push((depth, Value::text(name.as_str()), 0, None));
+            if nodes.is_empty() {
+                out.push(Line { kind: LineKind::Item(false), leaf: true, path: prefix.clone(), values: true, labels, vi: Some(vi) });
+            } else {
+                self.flatten_tabular(nodes, depth, Some(vi), prefix, &labels, out);
+            }
+        }
+    }
+
+    fn flatten_tabular(
+        &self,
+        nodes: &[Node],
+        depth: usize,
+        vi: Option<usize>,
+        prefix: &mut Vec<u32>,
+        pending: &[(usize, Value, u8, Option<String>)],
+        out: &mut Vec<Line>,
+    ) {
+        if self.values_here(depth, vi) {
+            self.flatten_tabular_values(nodes, depth, prefix, pending, out);
+            return;
+        }
         let n = self.rows.len();
+        let values_below = vi.is_none() && self.vpos.is_some();
+        let col = depth + usize::from(vi.is_some() && self.vpos.is_some());
         for (i, node) in nodes.iter().enumerate() {
             prefix.push(node.item);
             let (v, fmt, label) = self.label_cell(depth, node.item);
             let mut labels: Vec<(usize, Value, u8, Option<String>)> = if i == 0 { pending.to_vec() } else { vec![] };
-            labels.push((depth, v, 0, fmt));
+            labels.push((col, v, 0, fmt));
             let collapsed = depth + 1 < n && self.rows.get(depth).is_some_and(|f| is_collapsed(f, &label));
             if depth + 1 >= n || collapsed || node.children.is_empty() {
-                out.push(Line { kind: LineKind::Item(false), leaf: true, path: prefix.clone(), values: true, labels });
+                if values_below {
+                    self.flatten_tabular_values(&[], self.vpos.unwrap_or(depth + 1), prefix, &labels, out);
+                } else {
+                    out.push(Line { kind: LineKind::Item(false), leaf: true, path: prefix.clone(), values: true, labels, vi });
+                }
             } else {
-                self.flatten_tabular(&node.children, depth + 1, prefix, &labels, out);
-                if self.pt.subtotals {
+                self.flatten_tabular(&node.children, depth + 1, vi, prefix, &labels, out);
+                if self.pt.subtotals && values_below {
+                    self.value_subtotals(col, 0, &label, prefix, out);
+                } else if self.pt.subtotals {
                     out.push(Line {
                         kind: LineKind::Subtotal,
                         leaf: false,
                         path: prefix.clone(),
                         values: true,
-                        labels: vec![(depth, Value::text(format!("{label} Total")), 0, None)],
+                        labels: vec![(col, Value::text(format!("{label} Total")), 0, None)],
+                        vi,
                     });
                 }
             }
@@ -693,6 +813,12 @@ enum ValSrc {
     Calc(usize),
 }
 
+/// True when `col_groups` distinct column leaves (plus the grand-total column) times `values` value fields
+/// (at least one data column per group) already exceed the sheet width. This is a lower bound on the final column count.
+fn data_cols_exceed_sheet(col_groups: usize, grand_total: bool, values: usize) -> bool {
+    (col_groups + usize::from(grand_total)).saturating_mul(values.max(1)) > MAX_COLS as usize
+}
+
 /// Computes a PivotTable report from the workbook.
 pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Output, String> {
     let src = read_source(wb, &pt.source, pivot_sheet)?;
@@ -745,6 +871,14 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
 
     let k = vals.len();
     let empty = rows.is_empty() && cols.is_empty() && vals.is_empty();
+    // Σ Values in Rows (it exists with two or more value fields): its depth among the row fields
+    // found in the source.
+    let vpos: Option<usize> = (pt.values_on_rows && k > 1).then(|| {
+        let p = pt.values_position.unwrap_or(pt.rows.len());
+        pt.rows.iter().take(p).filter(|f| src.col(&f.source_col).is_some()).count()
+    });
+    let on_rows = vpos.is_some();
+    let row_levels = rows.len() + usize::from(on_rows);
 
     // ---- aggregate
     let mut row_items: Vec<FieldItems> = rows.iter().map(|_| FieldItems::default()).collect();
@@ -752,6 +886,7 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
     let mut aggs: AggMap = HashMap::new();
     let mut row_set: HashSet<Vec<u32>> = HashSet::new();
     let mut col_set: HashSet<Vec<u32>> = HashSet::new();
+    let mut col_leaves: HashSet<Vec<u32>> = HashSet::new();
     let filter_fmts: Vec<String> = filters.iter().map(|f| fmt_of(f.0)).collect();
     let row_fmts: Vec<String> = rows.iter().map(|(c, _)| fmt_of(*c)).collect();
     let col_fmts: Vec<String> = cols.iter().map(|(c, _)| fmt_of(*c)).collect();
@@ -788,8 +923,22 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
                 }
             }
         }
+        // The column leaf this record lands in: its path cut after the first collapsed item (as in `flatten_cols`).
+        let shown = cols
+            .iter()
+            .zip(col_items.iter())
+            .zip(cp.iter())
+            .position(|(((_, f), fi), &it)| !f.collapsed_items.is_empty() && is_collapsed(f, &fi.label(it)))
+            .map_or(cp.len(), |d| d + 1);
+        if !col_leaves.contains(&cp[..shown]) {
+            col_leaves.insert(cp[..shown].to_vec());
+        }
         row_set.insert(rp);
         col_set.insert(cp);
+        // Refuse a report that cannot fit before the accumulators for more column groups are allocated.
+        if !cols.is_empty() && data_cols_exceed_sheet(col_leaves.len(), pt.grand_totals_rows, k) {
+            return Err("The PivotTable report will not fit on the sheet.".into());
+        }
         if aggs.len() > 5_000_000 {
             return Err("The PivotTable report is too large.".into());
         }
@@ -806,24 +955,32 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
     collect_siblings(&row_tree, &mut Vec::new(), &mut siblings);
     let level0: Vec<u32> = row_tree.iter().map(|n| n.item).collect();
 
-    let ctx = Ctx { pt, rows: row_fields.clone(), row_items, row_fmts: row_fmts.clone() };
+    let val_names: Vec<String> = vals.iter().map(|(_, v)| v.name.clone()).collect();
+    let ctx = Ctx { pt, rows: row_fields.clone(), row_items, row_fmts: row_fmts.clone(), vpos, val_names: val_names.clone() };
     let mut lines: Vec<Line> = Vec::new();
-    if rows.is_empty() {
-        lines.push(Line { kind: LineKind::Item(false), leaf: true, path: vec![], values: true, labels: vec![] });
+    if row_levels == 0 {
+        lines.push(Line { kind: LineKind::Item(false), leaf: true, path: vec![], values: true, labels: vec![], vi: None });
     } else {
         if pt.layout == PivotLayout::Tabular {
-            ctx.flatten_tabular(&row_tree, 0, &mut Vec::new(), &[], &mut lines);
+            ctx.flatten_tabular(&row_tree, 0, None, &mut Vec::new(), &[], &mut lines);
         } else {
-            ctx.flatten(&row_tree, 0, &mut Vec::new(), &mut lines);
+            ctx.flatten(&row_tree, 0, None, &mut Vec::new(), &mut lines);
         }
-        if pt.grand_totals_cols {
-            lines.push(Line {
+        // With only Σ Values in Rows its items are the totals already.
+        if pt.grand_totals_cols && !rows.is_empty() {
+            let grand = |text: String, vi: Option<usize>| Line {
                 kind: LineKind::Grand,
                 leaf: false,
                 path: vec![],
                 values: true,
-                labels: vec![(0, Value::text("Grand Total"), 0, None)],
-            });
+                labels: vec![(0, Value::text(text), 0, None)],
+                vi,
+            };
+            if on_rows {
+                lines.extend(val_names.iter().enumerate().map(|(vi, name)| grand(format!("Total {name}"), Some(vi))));
+            } else {
+                lines.push(grand("Grand Total".into(), None));
+            }
         }
     }
     let mut specs: Vec<ColSpec> = Vec::new();
@@ -837,7 +994,10 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
     }
     let mut data_cols: Vec<(usize, Option<usize>)> = Vec::new();
     for (si, _) in specs.iter().enumerate() {
-        if k == 0 {
+        if on_rows {
+            // Each line names its value field; one data column per column item.
+            data_cols.push((si, None));
+        } else if k == 0 {
             if !cols.is_empty() {
                 data_cols.push((si, None));
             }
@@ -852,12 +1012,12 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
     }
 
     let compact = pt.layout == PivotLayout::Compact;
-    let l = if rows.is_empty() && cols.is_empty() {
+    let l = if row_levels == 0 && cols.is_empty() {
         0
     } else if compact {
         1
     } else {
-        rows.len().max(1)
+        row_levels.max(1)
     };
     let mut width = l + data_cols.len();
     if !shown_filters.is_empty() {
@@ -903,14 +1063,19 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
     let val_name = |vi: usize| vals.get(vi).map(|(_, v)| v.name.clone()).unwrap_or_default();
     let headers_on = pt.show_headers;
     let row_header = |g: &mut Grid, r: usize| {
-        if rows.is_empty() || !headers_on {
+        if row_levels == 0 || !headers_on {
             return;
         }
         if compact {
             g.set(r, 0, Value::text("Row Labels"), CellKind::Header, 0, None);
         } else {
-            for (i, f) in row_fields.iter().enumerate() {
-                g.set(r, i, Value::text(f.source_col.as_str()), CellKind::Header, 0, None);
+            // One column per row field, Σ Values ("Values") at its place.
+            let mut names: Vec<&str> = row_fields.iter().map(|f| f.source_col.as_str()).collect();
+            if let Some(p) = vpos {
+                names.insert(p.min(names.len()), "Values");
+            }
+            for (i, name) in names.into_iter().enumerate() {
+                g.set(r, i, Value::text(name), CellKind::Header, 0, None);
             }
         }
     };
@@ -920,8 +1085,11 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
         let r = g.push_row(RowKind::Header)?;
         row_header(&mut g, r);
         for (j, (_, vi)) in data_cols.iter().enumerate() {
-            if let Some(vi) = vi {
-                g.set(r, l + j, Value::text(val_name(*vi)), CellKind::Header, 0, None);
+            match vi {
+                Some(vi) => g.set(r, l + j, Value::text(val_name(*vi)), CellKind::Header, 0, None),
+                // Values on rows, no column field: the one data column is the grand total.
+                None if on_rows => g.set(r, l + j, Value::text("Total"), CellKind::Header, 0, None),
+                None => {}
             }
         }
     } else {
@@ -933,7 +1101,7 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
             let caption = if compact { "Column Labels".to_string() } else { col_fields.first().map(|f| f.source_col.clone()).unwrap_or_default() };
             g.set(cap, l, Value::text(caption), CellKind::Header, 0, None);
         }
-        let levels = cols.len() + usize::from(k > 1);
+        let levels = cols.len() + usize::from(k > 1 && !on_rows);
         let first_level = g.rows.len();
         for _ in 0..levels {
             g.push_row(RowKind::Header)?;
@@ -1048,17 +1216,19 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
                 && (k > 1 || parts.is_empty())
             {
                 parts.push(val_name(*vi));
+            } else if parts.is_empty() {
+                parts.push("Total".into());
             }
             Some(((l + j) as u32, parts.join(" - ")))
         })
         .filter(|_| k > 0)
         .collect();
-    let label_col = if rows.is_empty() {
+    let label_col = if row_levels == 0 {
         None
     } else if compact {
         Some(0)
     } else {
-        Some(rows.len().saturating_sub(1) as u32)
+        Some(row_levels.saturating_sub(1) as u32)
     };
     for line in &lines {
         let rk = match line.kind {
@@ -1082,8 +1252,9 @@ pub fn compute(wb: &Workbook, pt: &PivotTable, pivot_sheet: usize) -> Result<Out
             continue;
         }
         let rp = line.path.as_slice();
-        for (j, (si, vi)) in data_cols.iter().enumerate() {
-            let (Some(spec), Some(vi)) = (specs.get(*si), vi) else { continue };
+        for (j, (si, col_vi)) in data_cols.iter().enumerate() {
+            let line_vi = col_vi.or(line.vi);
+            let (Some(spec), Some(vi)) = (specs.get(*si), &line_vi) else { continue };
             let Some((_, vdef)) = vals.get(*vi) else { continue };
             let cp = spec.path.as_slice();
             let Some(raw) = get(rp, cp, *vi) else { continue };
@@ -1397,6 +1568,7 @@ pub fn chart_series(sheet: &str, origin: CellRef, out: &Output) -> Vec<Series> {
                 secondary: false,
                 kind: None,
                 smooth: false,
+                trendlines: Vec::new(),
             })
         })
         .collect()
@@ -1427,3 +1599,17 @@ pub fn clear_output(wb: &mut Workbook, sheet: usize, idx: usize) {
         p.last_range = None;
     }
 }
+
+#[cfg(test)]
+mod fit_tests {
+    use super::data_cols_exceed_sheet;
+
+    #[test]
+    fn column_budget_counts_value_fields_and_grand_total() {
+        assert!(!data_cols_exceed_sheet(64, true, 128));
+        assert!(data_cols_exceed_sheet(64, true, 256));
+        assert!(!data_cols_exceed_sheet(64, false, 256));
+        assert!(!data_cols_exceed_sheet(16_384, false, 0));
+        assert!(data_cols_exceed_sheet(16_385, false, 0));
+    }
+}

crates/engine/src/sample.rs

@@ -109,6 +109,7 @@ fn sales(s: &mut Session) -> bool {
                 secondary: false,
                 kind: None,
                 smooth: false,
+                trendlines: Vec::new(),
             }];
         }
     }

crates/engine/src/selection.rs

@@ -43,6 +43,13 @@ impl Selection {
     pub fn is_single_cell(&self) -> bool {
         self.ranges.len() == 1 && self.current().is_single()
     }
+    /// The corner of the current area opposite the anchor: the end that Shift+arrows move.
+    pub fn moving_end(&self) -> CellRef {
+        let r = self.current();
+        let row = if self.anchor.row == r.start.row { r.end.row } else { r.start.row };
+        let col = if self.anchor.col == r.start.col { r.end.col } else { r.start.col };
+        CellRef::new(row, col)
+    }
     /// Extends the current area from the anchor to `to` (Shift+click / Shift+arrows).
     pub fn extend_to(&mut self, to: CellRef) {
         let r = RangeRef::new(self.anchor, to);

crates/engine/src/tables.rs

@@ -176,8 +176,15 @@ pub(crate) fn sync_headers(cx: &mut crate::cmd::Ctx) {
         let Some(t) = sh.tables.get(ti) else { continue };
         let col = (c.col - t.range.start.col) as usize;
         let Some(old) = t.columns.get(col).map(|x| x.name.clone()) else { continue };
-        let text = crate::display::cell_text(&cx.wb, sh, c);
-        let is_text = sh.value(c).is_text();
+        // A text header names its column as it is: a number format only changes how it looks (an
+        // accounting format pads text with spaces), and the file writes the name into the cell.
+        let value = sh.value(c);
+        let text = match value.as_text() {
+            Some(t) => t.to_string(),
+            None => crate::display::cell_text(&cx.wb, sh, c),
+        };
+        // Headers hold constant text: a formula (or a spilled value) there becomes its text.
+        let is_text = value.is_text() && sh.cell(c).is_some_and(|x| x.formula.is_none());
         if text == old && is_text {
             continue;
         }

crates/engine/tests/autofit_filter_buttons.rs

@@ -0,0 +1,102 @@
+use gridcraft_core::CellRef;
+use gridcraft_engine::Session;
+use serde_json::json;
+
+fn table() -> Session {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range":"A1", "values":[["Quarterly Revenue"], ["1"]]})).unwrap();
+    s.execute("insert.table", json!({"range":"A1:A2", "header":true})).unwrap();
+    s
+}
+
+fn fit(s: &mut Session) -> f32 {
+    s.execute("home.autofitColumnWidth", json!({"cols":"A:A"})).unwrap();
+    s.doc().unwrap().wb.active().unwrap().col_width(0)
+}
+
+#[test]
+fn autofit_reserves_room_for_table_filter_button() {
+    let mut s = table();
+    s.execute("selection.set", json!({"cell":"A1"})).unwrap();
+    s.execute("data.filter", json!({})).unwrap();
+    let plain = fit(&mut s);
+    s.execute("data.filter", json!({})).unwrap();
+    let filtered = fit(&mut s);
+    assert!(filtered >= plain + 16.0, "filter button obscures heading: plain={plain}, filtered={filtered}");
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().value(CellRef::new(0, 0)).display(), "Quarterly Revenue");
+}
+
+fn sheet_mut(s: &mut Session) -> &mut gridcraft_engine::model::Sheet {
+    std::sync::Arc::make_mut(&mut s.active_mut().unwrap().wb).sheet_mut(0).unwrap()
+}
+
+#[test]
+fn autofit_skips_disabled_buttons_and_hidden_table_headers() {
+    let mut s = table();
+    sheet_mut(&mut s).tables[0].filter_button = false;
+    let plain = fit(&mut s);
+    sheet_mut(&mut s).tables[0].filter_button = true;
+    sheet_mut(&mut s).tables[0].header_row = false;
+    assert_eq!(fit(&mut s), plain);
+    sheet_mut(&mut s).tables[0].header_row = true;
+    assert!(fit(&mut s) > plain);
+}
+
+#[test]
+fn autofit_matches_excel_filter_allowance_across_zoom_and_row_heights() {
+    for (zoom, allowance) in [(50, 12.5 * 96.0 / 72.0 * 2.0), (100, 12.5 * 96.0 / 72.0), (200, 12.5 * 96.0 / 72.0)] {
+        for height in [12.0_f32, 20.0, 60.0] {
+            let mut s = table();
+            s.execute("view.zoom", json!({"percent":zoom})).unwrap();
+            s.execute("home.rowHeight", json!({"rows":"1:1", "height":height})).unwrap();
+            sheet_mut(&mut s).tables[0].filter_button = false;
+            let plain = fit(&mut s);
+            sheet_mut(&mut s).tables[0].filter_button = true;
+            let filtered = fit(&mut s);
+            assert!((filtered - plain - allowance).abs() < 1.0, "zoom={zoom}, height={height}, plain={plain}, filtered={filtered}");
+        }
+    }
+}
+
+#[test]
+fn autofit_supports_ordinary_autofilters_without_double_counting_table_buttons() {
+    let mut s = table();
+    let table_width = fit(&mut s);
+    sheet_mut(&mut s).autofilter =
+        Some(gridcraft_engine::model::AutoFilter { range: gridcraft_engine::core::RangeRef::parse("A1:A2").unwrap(), criteria: vec![] });
+    assert_eq!(fit(&mut s), table_width, "overlapping filters occupy one button slot");
+    sheet_mut(&mut s).tables.clear();
+    assert_eq!(fit(&mut s), table_width, "ordinary filter headers reserve the same space");
+    sheet_mut(&mut s).autofilter = None;
+    assert!(fit(&mut s) < table_width);
+}
+
+#[test]
+fn autofit_leaves_longer_body_cells_and_unfiltered_columns_unchanged() {
+    let mut s = table();
+    s.execute("cell.set", json!({"cell":"A2", "input":"A body value much longer than the short table header above"})).unwrap();
+    let filtered = fit(&mut s);
+    sheet_mut(&mut s).tables[0].filter_button = false;
+    assert_eq!(fit(&mut s), filtered);
+    s.execute("cell.set", json!({"cell":"B1", "input":"Quarterly Revenue"})).unwrap();
+    s.execute("home.autofitColumnWidth", json!({"cols":"B:B"})).unwrap();
+    let plain = s.doc().unwrap().wb.active().unwrap().col_width(1);
+    sheet_mut(&mut s).tables[0].filter_button = true;
+    s.execute("home.autofitColumnWidth", json!({"cols":"B:B"})).unwrap();
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().col_width(1), plain);
+}
+
+#[test]
+fn autofit_filter_width_is_undoable_without_changing_selection() {
+    let mut s = table();
+    s.execute("home.columnWidth", json!({"cols":"A:A", "width":80})).unwrap();
+    s.execute("selection.set", json!({"range":"A:A"})).unwrap();
+    let selection = s.doc().unwrap().selection.clone();
+    s.active_mut().unwrap().undo.clear();
+    fit(&mut s);
+    assert_eq!(s.doc().unwrap().selection, selection);
+    assert_eq!(s.doc().unwrap().undo.len(), 1);
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().col_width(0), 80.0);
+}

crates/engine/tests/csv_export_budget.rs

@@ -0,0 +1,45 @@
+//! CSV and TSV export is capped: two cells far apart in a sheet would otherwise make a file as
+//! big as the whole rectangle between them. A refused export is an error and writes nothing.
+
+use gridcraft_engine::Session;
+use serde_json::json;
+
+fn two_far_cells() -> Session {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("cell.set", json!({"cell": "A1", "input": "a"})).unwrap();
+    s.execute("cell.set", json!({"cell": "XFD1048576", "input": "b"})).unwrap();
+    s
+}
+
+#[test]
+fn a_sparse_sheet_spanning_the_grid_is_refused_not_expanded() {
+    let mut s = two_far_cells();
+    for format in ["csv", "tsv"] {
+        let err = s.execute("file.saveBytes", json!({"format": format})).unwrap_err().to_string();
+        assert!(err.contains("1048576 rows by 16384 columns") && err.contains("MiB"), "{format}: {err}");
+    }
+    // Save As and Export write no file, and the document stays as it was.
+    let dir = std::env::temp_dir().join(format!("gridcraft-csv-budget-{}", std::process::id()));
+    std::fs::create_dir_all(&dir).unwrap();
+    let path = dir.join("big.csv");
+    let err = s.execute("file.exportCsv", json!({"path": path.to_str().unwrap()})).unwrap_err().to_string();
+    assert!(err.contains("over the limit"), "{err}");
+    assert!(!path.exists(), "nothing is written for a refused export");
+    std::fs::remove_dir_all(&dir).unwrap();
+    // Other formats are unaffected, and so is a small export from the same session.
+    assert!(s.execute("file.saveBytes", json!({"format": "xlsx"})).is_ok());
+    s.execute("cell.set", json!({"cell": "XFD1048576", "input": ""})).unwrap();
+    assert_eq!(s.execute("file.saveBytes", json!({"format": "csv"})).unwrap()["bytes"], 3);
+}
+
+#[test]
+fn exports_below_the_cap_keep_their_positions() {
+    for (corner, bytes) in [("C3", 14), ("Z10", 272), ("XFD8", 131_082)] {
+        let mut s = Session::new();
+        s.new_workbook();
+        s.execute("cell.set", json!({"cell": "A1", "input": "a"})).unwrap();
+        s.execute("cell.set", json!({"cell": corner, "input": "b"})).unwrap();
+        assert_eq!(s.execute("file.saveBytes", json!({"format": "csv"})).unwrap()["bytes"], bytes, "{corner}");
+    }
+}

crates/engine/tests/custom_view_freeze.rs

@@ -0,0 +1,28 @@
+use gridcraft_engine::Session;
+use serde_json::json;
+
+fn freeze(s: &Session) -> Option<(u32, u32)> {
+    s.doc().unwrap().wb.active().unwrap().freeze
+}
+
+#[test]
+fn showing_a_custom_view_restores_its_frozen_panes() {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("view.freezePanes", json!({"cell": "B2"})).unwrap();
+    s.execute("view.customViews", json!({"save": "Frozen"})).unwrap();
+    s.execute("view.unfreezePanes", json!({})).unwrap();
+    assert_eq!(freeze(&s), None);
+    s.execute("view.customViews", json!({"show": "Frozen"})).unwrap();
+    assert_eq!(freeze(&s), Some((1, 1)));
+}
+
+#[test]
+fn showing_an_unfrozen_custom_view_clears_current_panes() {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("view.customViews", json!({"save": "Plain"})).unwrap();
+    s.execute("view.freezePanes", json!({"cell": "B2"})).unwrap();
+    s.execute("view.customViews", json!({"show": "Plain"})).unwrap();
+    assert_eq!(freeze(&s), None);
+}

crates/engine/tests/ink_roundtrip.rs

@@ -0,0 +1,135 @@
+//! Native ink remains editable after XLSX saves, including a save after an unrelated cell edit.
+
+use gridcraft_engine::Session;
+use gridcraft_engine::cmd::draw::{ink_points, ink_width};
+use gridcraft_engine::core::{CellRef, Value};
+use gridcraft_engine::model::{Shape, ShapeKind};
+use serde_json::json;
+
+fn workbook() -> Session {
+    let mut session = Session::new();
+    session.new_workbook();
+    session
+}
+
+fn reopen(session: &mut Session) -> Session {
+    let saved = session.execute("file.saveBytes", json!({"format": "xlsx"})).unwrap();
+    let mut reopened = Session::new();
+    reopened.execute("file.open", json!({"name": "ink.xlsx", "base64": saved["base64"]})).unwrap();
+    reopened
+}
+
+fn shapes(session: &Session) -> &[Shape] {
+    &session.doc().unwrap().wb.active().unwrap().shapes
+}
+
+fn assert_anchor(actual: &Shape, expected: &Shape) {
+    assert_eq!(actual.anchor.cell, expected.anchor.cell);
+    assert_eq!(actual.anchor.mode, expected.anchor.mode);
+    for (name, actual, expected) in [
+        ("dx", actual.anchor.dx, expected.anchor.dx),
+        ("dy", actual.anchor.dy, expected.anchor.dy),
+        ("width", actual.anchor.width, expected.anchor.width),
+        ("height", actual.anchor.height, expected.anchor.height),
+    ] {
+        assert!((actual - expected).abs() < 0.001, "anchor {name}: {actual} != {expected}");
+    }
+}
+
+fn assert_ink(actual: &Shape, expected: &Shape) {
+    assert_eq!(actual.kind, ShapeKind::Ink);
+    let actual_points = ink_points(actual);
+    let expected_points = ink_points(expected);
+    assert_eq!(actual_points.len(), expected_points.len());
+    for (actual, expected) in actual_points.iter().zip(&expected_points) {
+        for axis in 0..2 {
+            // DrawingML quantizes coordinates to integer EMUs (9,525 per model unit).
+            assert!((actual[axis] - expected[axis]).abs() < 0.001, "point {actual:?} != {expected:?}");
+        }
+    }
+    assert_eq!(actual.line, expected.line);
+    assert_eq!(ink_width(actual), ink_width(expected));
+    assert_anchor(actual, expected);
+}
+
+#[test]
+fn ink_geometry_and_style_survive_two_saves_and_a_cell_edit() {
+    let mut session = workbook();
+    session
+        .execute("draw.stroke", json!({"points": [[130.5, 45.25], [172.5, 86.25], [151.5, 112.25], [215.5, 59.25]], "color": "#A12BCD", "width": 3}))
+        .unwrap();
+    session
+        .execute("draw.stroke", json!({"points": [[300, 180], [360, 180], [360, 230], [300, 230], [300, 180]], "color": "#16843B", "width": 7}))
+        .unwrap();
+    let expected = shapes(&session).to_vec();
+    assert_eq!(expected.len(), 2);
+
+    for pass in 0..2 {
+        session = reopen(&mut session);
+        assert_eq!(shapes(&session).len(), expected.len());
+        for (actual, expected) in shapes(&session).iter().zip(&expected) {
+            assert_ink(actual, expected);
+        }
+        if pass == 0 {
+            session.execute("cell.set", json!({"cell": "Z30", "input": "42"})).unwrap();
+        }
+    }
+    assert_eq!(session.doc().unwrap().wb.active().unwrap().value(CellRef::parse("Z30").unwrap()), Value::Number(42.0));
+}
+
+#[test]
+fn reopened_ink_can_still_be_converted_to_a_shape() {
+    for (points, expected_kind, expected_name) in [
+        (vec![[100, 100], [200, 100], [200, 180], [100, 180], [100, 100]], ShapeKind::Rectangle, "Rectangle"),
+        (vec![[100, 100], [140, 110], [220, 130]], ShapeKind::Line, "Line"),
+    ] {
+        let mut session = workbook();
+        session.execute("draw.stroke", json!({"points": points, "color": "#A12BCD", "width": 5})).unwrap();
+        let original = shapes(&session)[0].clone();
+        session = reopen(&mut session);
+        let id = shapes(&session)[0].id;
+        let converted = session.execute("draw.inkToShape", json!({"id": id})).unwrap();
+        assert_eq!(converted["kind"], expected_name);
+        let shape = &shapes(&session)[0];
+        assert_eq!(shape.kind, expected_kind);
+        assert_eq!(shape.line, original.line);
+        assert!(shape.text.is_empty());
+        assert_anchor(shape, &original);
+    }
+}
+
+#[test]
+fn ordinary_shape_text_is_not_mistaken_for_ink_points() {
+    let mut session = workbook();
+    session
+        .execute(
+            "insert.shape",
+            json!({"kind": "rectangle", "at": "D6", "width": 120, "height": 60, "fill": "#112233", "line": "#A12BCD", "text": "0.0,0.0;50.0,20.0"}),
+        )
+        .unwrap();
+    let original = shapes(&session)[0].clone();
+    for _ in 0..2 {
+        session = reopen(&mut session);
+        assert_eq!(shapes(&session).len(), 1);
+        let shape = &shapes(&session)[0];
+        assert_eq!(shape.kind, ShapeKind::Rectangle);
+        assert_eq!(shape.text, original.text);
+        assert_eq!(shape.fill, original.fill);
+        assert_eq!(shape.line, original.line);
+        assert_anchor(shape, &original);
+        assert!(session.execute("draw.inkToShape", json!({})).is_err());
+    }
+}
+
+#[test]
+fn horizontal_vertical_and_signed_highlighter_strokes_survive_reopening() {
+    for points in [vec![[25.1, 50.2], [140.3, 50.2]], vec![[40.2, 10.1], [40.2, 100.3]], vec![[-12.3, -4.2], [20.1, 10.2], [80.3, -1.4]]] {
+        let mut session = workbook();
+        session.execute("draw.stroke", json!({"points": points, "color": "#16843B", "width": 12})).unwrap();
+        let expected = shapes(&session)[0].clone();
+        for _ in 0..2 {
+            session = reopen(&mut session);
+            assert_ink(&shapes(&session)[0], &expected);
+        }
+    }
+}

crates/engine/tests/line_count_overflow.rs

@@ -0,0 +1,47 @@
+use gridcraft_engine::{EngineError, Session};
+use serde_json::json;
+
+fn new_session() -> Session {
+    let mut session = Session::new();
+    session.new_workbook();
+    session
+}
+
+#[test]
+fn insert_with_an_out_of_range_count_is_a_normal_error() {
+    for (id, key, at) in [("home.insertRows", "rows", "3:3"), ("home.insertColumns", "cols", "C:C")] {
+        let mut session = new_session();
+        let err = session.execute(id, json!({ key: at, "count": u32::MAX })).unwrap_err();
+        assert!(matches!(err, EngineError::BadParams { .. }), "{id}: {err:?}");
+    }
+}
+
+#[test]
+fn insert_after_a_formatted_line_with_an_out_of_range_count_is_a_normal_error() {
+    // A custom size on the preceding line and no cells: the used-range guard has nothing to check.
+    let mut session = new_session();
+    session.execute("home.rowHeight", json!({"rows": "2:2", "height": 30})).unwrap();
+    let err = session.execute("home.insertRows", json!({"rows": "3:3", "count": u32::MAX})).unwrap_err();
+    assert!(matches!(err, EngineError::BadParams { .. }), "{err:?}");
+
+    let mut session = new_session();
+    session.execute("home.columnWidth", json!({"cols": "B:B", "width": 100})).unwrap();
+    let err = session.execute("home.insertColumns", json!({"cols": "C:C", "count": u32::MAX})).unwrap_err();
+    assert!(matches!(err, EngineError::BadParams { .. }), "{err:?}");
+}
+
+#[test]
+fn delete_with_an_out_of_range_count_does_not_panic() {
+    for (id, key, at) in [("home.deleteRows", "rows", "3:3"), ("home.deleteColumns", "cols", "C:C")] {
+        let mut session = new_session();
+        let res = session.execute(id, json!({ key: at, "count": u32::MAX }));
+        assert!(!matches!(res, Err(EngineError::Internal(..))), "{id}: {res:?}");
+    }
+}
+
+#[test]
+fn insert_and_delete_with_a_small_count_still_work() {
+    let mut session = new_session();
+    session.execute("home.insertRows", json!({"rows": "1:1", "count": 3})).unwrap();
+    session.execute("home.deleteRows", json!({"rows": "1:1", "count": 3})).unwrap();
+}

crates/engine/tests/offset_overflow.rs

@@ -0,0 +1,24 @@
+use gridcraft_core::{CellError, CellRef, Value};
+use gridcraft_engine::Session;
+use serde_json::json;
+
+#[test]
+fn cell_set_offset_extreme_arguments_return_ref() {
+    let mut session = Session::new();
+    session.new_workbook();
+    for formula in [
+        "=OFFSET(B2,1E300,0)",
+        "=OFFSET(B2,0,1E300)",
+        "=OFFSET(B2,0,0,1E300,1)",
+        "=OFFSET(B2,0,0,1,1E300)",
+        "=OFFSET(B2,-1E300,0)",
+        "=OFFSET(B2,0,-1E300)",
+        "=OFFSET(B2,0,0,-1E300,1)",
+        "=OFFSET(B2,0,0,1,-1E300)",
+        "=OFFSET(B2,1E300,0,-1E300,1)",
+        "=OFFSET(B2,0,1E300,1,-1E300)",
+    ] {
+        session.execute("cell.set", json!({"cell": "D1", "input": formula})).unwrap();
+        assert_eq!(session.doc().unwrap().wb.sheet(0).unwrap().value(CellRef::new(0, 3)), Value::Error(CellError::Ref), "{formula}");
+    }
+}

crates/engine/tests/row_autofit.rs

@@ -0,0 +1,61 @@
+//! Whole-row and whole-column formatting must re-fit row heights (issue #833).
+
+use serde_json::json;
+
+fn sheet_mut(s: &mut gridcraft_engine::Session) -> &mut gridcraft_engine::model::Sheet {
+    std::sync::Arc::make_mut(&mut s.active_mut().unwrap().wb).sheet_mut(0).unwrap()
+}
+
+#[test]
+fn whole_row_font_format_grows_row_height_and_undoes() {
+    let mut s = gridcraft_engine::Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A5", "values": [["plain big bold"]]})).unwrap();
+    let before = s.doc().unwrap().wb.active().unwrap().row_height(4);
+    s.execute("home.fontSize", json!({"range": "5:5", "size": 20})).unwrap();
+    let after = s.doc().unwrap().wb.active().unwrap().row_height(4);
+    assert!(after > before + 10.0, "20pt whole-row format should grow the row: before={before}, after={after}");
+    s.execute("edit.undo", json!({})).unwrap();
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().row_height(4), before, "undo must restore the height");
+}
+
+#[test]
+fn whole_column_font_format_grows_only_rows_with_cells() {
+    let mut s = gridcraft_engine::Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1", "values": [["a"]]})).unwrap();
+    s.execute("range.setValues", json!({"range": "A50", "values": [["b"]]})).unwrap();
+    s.execute("home.fontSize", json!({"range": "A:A", "size": 20})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert!(sh.row_height(0) > 30.0 && sh.row_height(49) > 30.0, "rows with cells grow");
+    assert!(sh.rows.len() <= 3, "full-column format must fit only rows that have cells, rows map has {} entries", sh.rows.len());
+}
+
+#[test]
+fn whole_row_format_does_not_resize_custom_height_rows() {
+    let mut s = gridcraft_engine::Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A5", "values": [["plain big bold"]]})).unwrap();
+    {
+        let sh = sheet_mut(&mut s);
+        let e = sh.rows.entry(4).or_default();
+        e.custom = true;
+        e.size = Some(25.0);
+    }
+    s.execute("home.fontSize", json!({"range": "5:5", "size": 20})).unwrap();
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().row_height(4), 25.0, "custom-height rows keep their height");
+}
+
+#[test]
+fn whole_row_format_keeps_hidden_rows_hidden() {
+    let mut s = gridcraft_engine::Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A5", "values": [["plain big bold"]]})).unwrap();
+    let before = s.doc().unwrap().wb.active().unwrap().row_height(4);
+    sheet_mut(&mut s).rows.entry(4).or_default().hidden = true;
+    s.execute("home.fontSize", json!({"range": "5:5", "size": 20})).unwrap();
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    let info = sh.rows.get(&4).unwrap();
+    assert!(info.size.unwrap_or(before) > before + 10.0, "hidden row still grows to its font: before={before}, size={:?}", info.size);
+    assert!(info.hidden, "formatting a hidden row must not unhide it");
+}

crates/engine/tests/stored_list_shape.rs

@@ -0,0 +1,48 @@
+use gridcraft_engine::Session;
+use serde_json::json;
+
+const NOT_OBJECTS: [&str; 4] = ["\"[1,2]\"", "\"7\"", "\"true\"", "\"\"\"hi\"\"\""];
+
+fn with_name(name: &str, refers_to: &str) -> Session {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("formulas.defineName", json!({"name": name, "refersTo": refers_to})).unwrap();
+    s
+}
+
+#[test]
+fn saving_a_view_works_when_stored_list_is_not_an_object() {
+    for text in NOT_OBJECTS {
+        let mut s = with_name("_sc_custom_views", text);
+        let out = s.execute("view.customViews", json!({"save": "v"})).unwrap();
+        assert!(out.get("v").is_some(), "{text}: {out}");
+    }
+}
+
+#[test]
+fn saving_a_view_keeps_the_keys_of_a_stored_object() {
+    let mut s = with_name("_sc_custom_views", "\"{\"\"a\"\":1}\"");
+    let out = s.execute("view.customViews", json!({"save": "v"})).unwrap();
+    assert!(out.get("a").is_some() && out.get("v").is_some(), "{out}");
+}
+
+#[test]
+fn creating_a_script_works_when_stored_list_is_not_an_object() {
+    for text in NOT_OBJECTS {
+        let mut s = with_name("_sc_scripts", text);
+        s.execute("automate.newScript", json!({"name": "s1", "commands": []})).unwrap();
+        let list = s.execute("automate.allScripts", json!({})).unwrap();
+        assert!(list.to_string().contains("s1"), "{text}: {list}");
+    }
+}
+
+#[test]
+fn stopping_a_recording_works_when_stored_list_is_not_an_object() {
+    for text in NOT_OBJECTS {
+        let mut s = with_name("_sc_scripts", text);
+        s.execute("automate.recordActions", json!({})).unwrap();
+        s.execute("automate.recordActions", json!({"stop": true, "name": "s1"})).unwrap();
+        let list = s.execute("automate.allScripts", json!({})).unwrap();
+        assert!(list.to_string().contains("s1"), "{text}: {list}");
+    }
+}

crates/engine/tests/table_resize_overlap.rs

@@ -0,0 +1,29 @@
+use gridcraft_engine::Session;
+use serde_json::json;
+
+fn table() -> Session {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range":"A1", "values":[["Item", "Qty"], ["x", "7"]]})).unwrap();
+    s.execute("insert.table", json!({"range":"A1:B2", "header":true, "name":"T"})).unwrap();
+    s
+}
+
+fn table_range(s: &Session) -> String {
+    s.doc().unwrap().wb.active().unwrap().tables[0].range.a1()
+}
+
+#[test]
+fn resize_to_disjoint_range_is_rejected_and_keeps_table() {
+    let mut s = table();
+    assert!(s.execute("table.resize", json!({"table":"T", "range":"D1:E2"})).is_err());
+    assert_eq!(table_range(&s), "A1:B2");
+    assert_eq!(s.doc().unwrap().wb.active().unwrap().tables[0].columns[1].name, "Qty");
+}
+
+#[test]
+fn resize_to_overlapping_range_still_works() {
+    let mut s = table();
+    s.execute("table.resize", json!({"table":"T", "range":"B1:C2"})).unwrap();
+    assert_eq!(table_range(&s), "B1:C2");
+}

crates/engine/tests/table_total_row_last_row.rs

@@ -0,0 +1,34 @@
+use gridcraft_core::{CellRef, MAX_ROWS};
+use gridcraft_engine::Session;
+use serde_json::json;
+
+fn refused(range: &str) {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("insert.table", json!({"range": range, "header": true})).unwrap();
+    let before = s.doc().unwrap().wb.active().unwrap().tables[0].clone();
+    assert!(s.execute("table.totalRow", json!({"on": true, "table": &before.name})).is_err(), "{range}");
+    let sh = s.doc().unwrap().wb.active().unwrap();
+    assert_eq!(sh.tables[0].range, before.range, "{range}");
+    assert_eq!(sh.tables[0].range.end.row, MAX_ROWS - 1, "{range}");
+    assert!(!sh.tables[0].totals_row, "{range}");
+    assert!(sh.value(CellRef::new(MAX_ROWS, 0)).is_empty(), "{range}");
+}
+
+#[test]
+fn total_row_is_refused_on_a_table_ending_at_the_last_worksheet_row() {
+    refused("A1048575:B1048576");
+    refused("A1048576:B1048576");
+}
+
+#[test]
+fn total_row_still_grows_an_ordinary_table() {
+    let mut s = Session::new();
+    s.new_workbook();
+    s.execute("range.setValues", json!({"range": "A1", "values": [["Item", "Amount"], ["a", 2], ["b", 3]]})).unwrap();
+    s.execute("insert.table", json!({"range": "A1:B3", "header": true})).unwrap();
+    s.execute("table.totalRow", json!({"on": true, "table": "Table1"})).unwrap();
+    let t = &s.doc().unwrap().wb.active().unwrap().tables[0];
+    assert!(t.totals_row);
+    assert_eq!(t.range.end.row, 3);
+}

crates/formula/src/adjust.rs

@@ -264,11 +264,10 @@ pub fn rename_sheet(e: Expr, old: &str, new: &str) -> Expr {
             }
             Expr::Ref(r)
         }
-        // Sheet-qualified defined name `Old!MyName` is stored as one string.
+        // Sheet-qualified defined name `Old!MyName` is stored as one string, with the bare sheet name as the parser
+        // stores it (the printer adds the quotes).
         Expr::Name(n) => match n.split_at_checked(old.len()) {
-            Some((head, rest)) if head.eq_ignore_ascii_case(old) && rest.starts_with('!') => {
-                Expr::Name(format!("{}{rest}", crate::printer::quote_sheet(new)))
-            }
+            Some((head, rest)) if head.eq_ignore_ascii_case(old) && rest.starts_with('!') => Expr::Name(format!("{new}{rest}")),
             _ => Expr::Name(n),
         },
         other => other,

crates/formula/src/ast.rs

@@ -91,6 +91,38 @@ pub enum UnOp {
     /// Spill range operator `A1#`: the whole spill range of the dynamic array anchored at the
     /// cell (`ANCHORARRAY` in files).
     Spill,
+    /// Trim reference `A1.:E10` / `A1:.E10` / `A1.:.E10` around a range: the range without its
+    /// blank leading, trailing or outer rows and columns (`TRIMRANGE` with both trim codes set).
+    Trim(TrimMode),
+}
+
+/// Which blank edges a trim reference drops.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum TrimMode {
+    /// `.:` — leading blank rows and columns.
+    Leading,
+    /// `:.` — trailing blank rows and columns.
+    Trailing,
+    /// `.:.` — both.
+    All,
+}
+
+impl TrimMode {
+    pub fn symbol(self) -> &'static str {
+        match self {
+            TrimMode::Leading => ".:",
+            TrimMode::Trailing => ":.",
+            TrimMode::All => ".:.",
+        }
+    }
+    /// The equivalent `TRIMRANGE` trim_rows / trim_cols code.
+    pub fn code(self) -> u8 {
+        match self {
+            TrimMode::Leading => 1,
+            TrimMode::Trailing => 2,
+            TrimMode::All => 3,
+        }
+    }
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, Serialize, Deserialize)]

crates/formula/src/lexer.rs

@@ -4,6 +4,8 @@
 
 use gridcraft_core::CellError;
 
+use crate::ast::TrimMode;
+
 #[derive(Clone, Debug, PartialEq)]
 pub enum Tok {
     Number(f64),
@@ -27,6 +29,8 @@ pub enum Tok {
     Comma,
     Semicolon,
     Colon,
+    /// Trim reference range operator `.:`, `:.` or `.:.`.
+    Trim(TrimMode),
     Space,
     Eof,
 }
@@ -49,6 +53,20 @@ fn is_word_char(c: char) -> bool {
     c.is_alphanumeric() || matches!(c, '_' | '.' | '$' | '\\' | '?')
 }
 
+/// `A1`, `$A$1`, `A`, `$A`, `1`, `$1`: a word that can end a range, so `A1.:` is a trim
+/// reference and not a name ending in a dot.
+fn is_range_end(w: &str) -> bool {
+    let s = w.strip_prefix('$').unwrap_or(w);
+    let (letters, rest) = s.split_at(s.find(|c: char| !c.is_ascii_alphabetic()).unwrap_or(s.len()));
+    let digits = if letters.is_empty() { rest } else { rest.strip_prefix('$').unwrap_or(rest) };
+    letters.len() <= 3 && if digits.is_empty() { !letters.is_empty() && rest.is_empty() } else { digits.bytes().all(|b| b.is_ascii_digit()) }
+}
+
+/// Whether `c` can start the second end of a range after `:.` (`A1:.E10`, `A:.$C`, `1:.5`).
+fn starts_range_end(c: Option<char>) -> bool {
+    c.is_some_and(|c| c.is_ascii_alphanumeric() || c == '$')
+}
+
 /// Tokenizes formula text (without the leading `=`).
 pub fn tokenize(src: &str) -> Result<Vec<Token>, LexError> {
     tokenize_locale(src, crate::FormulaLocale::En)
@@ -178,6 +196,16 @@ pub fn tokenize_locale(src: &str, locale: crate::FormulaLocale) -> Result<Vec<To
                 push(&mut out, Tok::Struct(inner), j);
                 i = j;
             }
+            '.' if ch(i + 1) == Some(':') => {
+                // Trim reference `A1.:E10` / `A1.:.E10` (the word before stopped at the dot).
+                if ch(i + 2) == Some('.') && starts_range_end(ch(i + 3)) {
+                    push(&mut out, Tok::Trim(TrimMode::All), i + 3);
+                    i += 3;
+                } else {
+                    push(&mut out, Tok::Trim(TrimMode::Leading), i + 2);
+                    i += 2;
+                }
+            }
             c if c.is_ascii_digit() || (c == locale.decimal_separator() && ch(i + 1).is_some_and(|d| d.is_ascii_digit())) => {
                 // Number, unless it is a row range like 1:3 (handled by parser via Word) — numbers
                 // followed by ':' and digits are row refs: lex as Word.
@@ -185,12 +213,22 @@ pub fn tokenize_locale(src: &str, locale: crate::FormulaLocale) -> Result<Vec<To
                 while ch(j).is_some_and(|d| d.is_ascii_digit()) {
                     j += 1;
                 }
-                let is_row_ref = ch(j) == Some(':') && {
-                    let mut k = j + 1;
-                    if ch(k) == Some('$') {
+                // Row ranges `1:3`, and the trim forms `1.:3`, `1:.3`, `1.:.3`.
+                let is_row_ref = {
+                    let mut k = j;
+                    if ch(k) == Some('.') && ch(k + 1) == Some(':') {
                         k += 1;
                     }
-                    ch(k).is_some_and(|d| d.is_ascii_digit())
+                    ch(k) == Some(':') && {
+                        k += 1;
+                        if ch(k) == Some('.') {
+                            k += 1;
+                        }
+                        if ch(k) == Some('$') {
+                            k += 1;
+                        }
+                        ch(k).is_some_and(|d| d.is_ascii_digit())
+                    }
                 };
                 // A word like "1A" can't happen in valid formulas; numbers then.
                 if is_row_ref {
@@ -252,8 +290,13 @@ pub fn tokenize_locale(src: &str, locale: crate::FormulaLocale) -> Result<Vec<To
                 i += 1;
             }
             ':' => {
-                push(&mut out, Tok::Colon, i + 1);
-                i += 1;
+                if ch(i + 1) == Some('.') && starts_range_end(ch(i + 2)) {
+                    push(&mut out, Tok::Trim(TrimMode::Trailing), i + 2);
+                    i += 2;
+                } else {
+                    push(&mut out, Tok::Colon, i + 1);
+                    i += 1;
+                }
             }
             '+' | '-' | '*' | '/' | '^' | '&' | '%' | '@' | '=' => {
                 let op = match c {
@@ -315,6 +358,11 @@ pub fn tokenize_locale(src: &str, locale: crate::FormulaLocale) -> Result<Vec<To
                 } else if w.eq_ignore_ascii_case("FALSE") && ch(j) != Some('[') {
                     push(&mut out, Tok::Bool(false), j);
                     i = j;
+                } else if w.len() > 1 && w.ends_with('.') && ch(j) == Some(':') && is_range_end(w.get(..w.len() - 1).unwrap_or("")) {
+                    // `A1.:E10`: the dot belongs to the trim operator, lexed next.
+                    let w = w.get(..w.len() - 1).unwrap_or("").to_string();
+                    push(&mut out, Tok::Word(w), j - 1);
+                    i = j - 1;
                 } else {
                     push(&mut out, Tok::Word(w), j);
                     i = j;

crates/formula/src/lib.rs

@@ -10,7 +10,7 @@ pub mod lexer;
 pub mod parser;
 pub mod printer;
 
-pub use ast::{Anchor, BinOp, Expr, RefKind, Reference, SheetSel, StructItem, StructRef, UnOp};
+pub use ast::{Anchor, BinOp, Expr, RefKind, Reference, SheetSel, StructItem, StructRef, TrimMode, UnOp};
 pub use input::{FormulaLocale, parse_input, print_input};
 pub use parser::{ParseError, normalize_function_name, parse};
 pub use printer::{print, print_r1c1, quote_sheet};

crates/formula/src/parser.rs

@@ -50,8 +50,9 @@ fn significant_spaces(toks: Vec<Token>) -> Vec<Token> {
     let mut out: Vec<Token> = Vec::with_capacity(toks.len());
     for (i, t) in toks.iter().enumerate() {
         if t.tok == Tok::Space {
-            let prev_end = out.last().is_some_and(|p| matches!(p.tok, Tok::Word(_) | Tok::RParen | Tok::Struct(_)));
-            let next_start = toks.get(i + 1).is_some_and(|n| matches!(n.tok, Tok::Word(_) | Tok::Sheet(..) | Tok::LParen | Tok::Func(_)));
+            let prev_end = out.last().is_some_and(|p| matches!(p.tok, Tok::Word(_) | Tok::RParen | Tok::Struct(_) | Tok::Error(_)));
+            let next_start =
+                toks.get(i + 1).is_some_and(|n| matches!(n.tok, Tok::Word(_) | Tok::Sheet(..) | Tok::LParen | Tok::Func(_) | Tok::Error(_)));
             if prev_end && next_start {
                 out.push(t.clone());
             }
@@ -88,15 +89,19 @@ fn word_is_cell(w: &str) -> Option<Anchor> {
     Some(Anchor { row, col, row_abs, col_abs })
 }
 
-/// `_xlfn.XLOOKUP` → `XLOOKUP`.
+/// `_xlfn.XLOOKUP` → `XLOOKUP`. `_xludf.` is kept (`_xludf.SUM`): it marks a user-defined
+/// function, never the built-in of the same name, and files need it back.
 pub fn normalize_function_name(name: &str) -> String {
     let u = name.to_ascii_uppercase();
-    for p in ["_XLFN._XLWS.", "_XLFN.", "_XLWS.", "_XLUDF."] {
+    for p in ["_XLFN._XLWS.", "_XLFN.", "_XLWS."] {
         if let Some(r) = u.strip_prefix(p) {
             return r.to_string();
         }
     }
-    u
+    match u.strip_prefix("_XLUDF.") {
+        Some(r) => format!("_xludf.{r}"),
+        None => u,
+    }
 }
 
 impl Parser {
@@ -174,6 +179,17 @@ impl Parser {
                 lhs = Expr::Invoke(Box::new(lhs), args);
                 continue;
             }
+            if let Tok::Trim(mode) = *self.peek() {
+                // A trim reference is the range operator with a modifier: same binding power.
+                let bp = BinOp::Range.precedence();
+                if bp < min_bp {
+                    break;
+                }
+                self.next();
+                let rhs = self.expr(bp + 1, allow_union)?;
+                lhs = Expr::Unary(UnOp::Trim(mode), Box::new(combine(BinOp::Range, lhs, rhs)));
+                continue;
+            }
             let Some(op) = self.binop(allow_union) else { break };
             let bp = op.precedence();
             if bp < min_bp {
@@ -243,6 +259,19 @@ impl Parser {
                 {
                     return Ok(Expr::Unary(UnOp::At, Box::new(x)));
                 }
+                // Files may spell a trim reference as a function call (`_xlfn._TRO_ALL(A1:E10)`).
+                let trim = match name.as_str() {
+                    "_TRO_LEADING" => Some(TrimMode::Leading),
+                    "_TRO_TRAILING" => Some(TrimMode::Trailing),
+                    "_TRO_ALL" => Some(TrimMode::All),
+                    _ => None,
+                };
+                if let Some(mode) = trim
+                    && args.len() == 1
+                    && let Some(x) = args.pop()
+                {
+                    return Ok(Expr::Unary(UnOp::Trim(mode), Box::new(x)));
+                }
                 Ok(Expr::Call(name, args))
             }
             Tok::Sheet(a, b) => {
@@ -260,27 +289,42 @@ impl Parser {
                 if let Tok::Struct(_) = self.peek()
                     && word_is_cell(&w).is_none()
                 {
+                    let pos = self.pos();
                     let Tok::Struct(body) = self.next() else { return Err(self.err("internal")) };
-                    return Ok(Expr::Struct(parse_struct(&w, &body)));
+                    return parse_struct(&w, &body).map(Expr::Struct).map_err(|msg| ParseError { msg, pos });
                 }
                 self.reference_from_word(SheetSel::Current, &w)
             }
-            Tok::Struct(body) => Ok(Expr::Struct(parse_struct("", &body))),
+            Tok::Struct(body) => parse_struct("", &body).map(Expr::Struct).map_err(|msg| self.err(msg)),
             t => Err(self.err(format!("unexpected {}", describe(&t)))),
         }
     }
 
-    /// A word after an optional sheet: a cell, a column/row range (`A:C`, `3:5`) or a name.
+    /// A word after an optional sheet: a cell, a column/row range (`A:C`, `3:5`) or a name. A
+    /// trim operator (`A1:.E10`, `A:.A`) in place of the colon wraps the range in
+    /// [`UnOp::Trim`].
     fn reference_from_word(&mut self, sheet: SheetSel, w: &str) -> Result<Expr, ParseError> {
+        let trim = match self.peek() {
+            Tok::Colon => Some(None),
+            Tok::Trim(mode) => Some(Some(*mode)),
+            _ => None,
+        };
+        let wrap = |kind: RefKind, sheet: SheetSel| {
+            let r = Expr::Ref(Reference { sheet, kind });
+            match trim {
+                Some(Some(mode)) => Expr::Unary(UnOp::Trim(mode), Box::new(r)),
+                _ => r,
+            }
+        };
         if let Some(a) = word_is_cell(w) {
             // Cell, possibly `A1:B2` (merged here so the sheet applies to both ends).
-            if *self.peek() == Tok::Colon
+            if trim.is_some()
                 && let Tok::Word(w2) = self.peek_at(1)
                 && let Some(b) = word_is_cell(w2)
             {
                 self.next();
                 self.next();
-                return Ok(Expr::Ref(Reference { sheet, kind: RefKind::Range(a, b) }));
+                return Ok(wrap(RefKind::Range(a, b), sheet));
             }
             let cell = Expr::Ref(Reference { sheet, kind: RefKind::Cell(a) });
             if *self.peek() == Tok::Op("#") {
@@ -294,18 +338,18 @@ impl Parser {
             Tok::Number(n) if n.fract() == 0.0 && *n >= 1.0 => Some(format!("{n}")),
             _ => None,
         };
-        if *self.peek() == Tok::Colon
+        if trim.is_some()
             && let Some(w2) = second
         {
             if let (Some((c0, a0)), Some((c1, a1))) = (word_is_cols(w), word_is_cols(&w2)) {
                 self.next();
                 self.next();
-                return Ok(Expr::Ref(Reference { sheet, kind: RefKind::Cols(c0, a0, c1, a1) }));
+                return Ok(wrap(RefKind::Cols(c0, a0, c1, a1), sheet));
             }
             if let (Some((r0, a0)), Some((r1, a1))) = (word_is_row(w), word_is_row(&w2)) {
                 self.next();
                 self.next();
-                return Ok(Expr::Ref(Reference { sheet, kind: RefKind::Rows(r0, a0, r1, a1) }));
+                return Ok(wrap(RefKind::Rows(r0, a0, r1, a1), sheet));
             }
         }
         if sheet != SheetSel::Current {
@@ -318,6 +362,10 @@ impl Parser {
         if w.chars().next().is_some_and(|c| c.is_ascii_digit()) {
             return Err(self.err(format!("unexpected `{w}`")));
         }
+        // A function passed by name is saved as `_xleta.SUM`.
+        if let Some(f) = w.get(..7).filter(|p| p.eq_ignore_ascii_case("_xleta.")).and_then(|_| w.get(7..)) {
+            return Ok(Expr::Name(f.to_ascii_uppercase()));
+        }
         Ok(Expr::Name(w.to_string()))
     }
 
@@ -372,10 +420,15 @@ fn combine(op: BinOp, lhs: Expr, rhs: Expr) -> Expr {
     Expr::Binary(op, Box::new(lhs), Box::new(rhs))
 }
 
-/// Parses the inside of `Table[...]`.
-pub fn parse_struct(table: &str, body: &str) -> StructRef {
+/// Parses the inside of `Table[...]`. Text between the bracketed items may only be the `,` and
+/// `:` separators, except one unbracketed column after `[#This Row],` (`[[#This Row],Units]`,
+/// how some writers spell `[@Units]`); anything else is an error rather than dropped.
+pub fn parse_struct(table: &str, body: &str) -> Result<StructRef, String> {
     let mut specifiers = Vec::new();
     let mut cols: Vec<String> = Vec::new();
+    // Spaces at the edges of a column name are part of it (`Table1[Qty ]` names `Qty `), so the
+    // untrimmed body is what a lone column is read from.
+    let raw = body;
     let body = body.trim();
     let unescape = |s: &str| {
         let mut out = String::new();
@@ -401,24 +454,41 @@ pub fn parse_struct(table: &str, body: &str) -> StructRef {
             _ => None,
         }
     };
+    let unexpected = |gap: &str| format!("unexpected `{gap}` in structured reference");
+    // A column name may hold `[` and `]` only when escaped with `'`.
+    let column = |s: &str| -> Result<String, String> {
+        let mut esc = false;
+        for c in s.chars() {
+            match c {
+                _ if esc => esc = false,
+                '\'' => esc = true,
+                '[' | ']' => return Err(unexpected(s)),
+                _ => {}
+            }
+        }
+        Ok(unescape(s))
+    };
     if !body.starts_with('[') {
         // Simple: [Col], [@Col], [#Headers], [@]
         if let Some(rest) = body.strip_prefix('@') {
             specifiers.push(StructItem::ThisRow);
-            let rest = rest.trim().trim_start_matches('[').trim_end_matches(']');
+            let rest = rest.trim();
+            let rest = rest.strip_prefix('[').and_then(|r| r.strip_suffix(']')).unwrap_or(rest);
             if !rest.is_empty() {
-                cols.push(unescape(rest));
+                cols.push(column(rest)?);
             }
         } else if let Some(i) = item(body) {
             specifiers.push(i);
         } else if !body.is_empty() {
-            cols.push(unescape(body));
+            cols.push(column(raw)?);
         }
     } else {
-        // [[#Headers],[Col1]:[Col3]] or [@[Col 1]]
+        // [[#Headers],[Col1]:[Col3]], [[#This Row],[Col 1]] or [[#This Row],Col1]
         let mut parts = Vec::new();
         let mut depth = 0;
         let mut cur = String::new();
+        // Text between bracketed items.
+        let mut gap = String::new();
         let mut esc = false;
         for c in body.chars() {
             if esc {
@@ -427,17 +497,26 @@ pub fn parse_struct(table: &str, body: &str) -> StructRef {
                 continue;
             }
             match c {
-                '\'' => {
+                '\'' if depth > 0 => {
                     cur.push(c);
                     esc = true;
                 }
                 '[' => {
+                    if depth == 0 {
+                        if !matches!(gap.trim(), "" | "," | ":") {
+                            return Err(unexpected(gap.trim()));
+                        }
+                        gap.clear();
+                    }
                     depth += 1;
                     if depth > 1 {
                         cur.push(c);
                     }
                 }
                 ']' => {
+                    if depth == 0 {
+                        return Err(unexpected("]"));
+                    }
                     depth -= 1;
                     if depth > 0 {
                         cur.push(c);
@@ -445,33 +524,35 @@ pub fn parse_struct(table: &str, body: &str) -> StructRef {
                         parts.push(std::mem::take(&mut cur));
                     }
                 }
-                ',' if depth == 0 => {}
-                ':' if depth == 0 => parts.push(":".into()),
                 _ if depth > 0 => cur.push(c),
-                _ => {}
+                _ => gap.push(c),
             }
         }
-        let mut range_next = false;
+        if depth > 0 {
+            return Err("unclosed `[` in structured reference".to_string());
+        }
         for p in parts {
-            if p == ":" {
-                range_next = true;
-                continue;
-            }
             if let Some(i) = item(&p) {
                 specifiers.push(i);
-            } else if range_next {
-                cols.push(unescape(&p));
-                range_next = false;
             } else {
-                cols.push(unescape(&p));
+                cols.push(column(&p)?);
             }
         }
-        if body.starts_with("@") {
-            specifiers.push(StructItem::ThisRow);
+        let tail = gap.trim();
+        if !tail.is_empty() {
+            let bare = tail.strip_prefix(',').map(str::trim).unwrap_or("");
+            let simple = !bare.is_empty() && !bare.chars().any(|c| matches!(c, '[' | ']' | '#' | '\'' | ',' | ':'));
+            if !(simple && specifiers == [StructItem::ThisRow] && cols.is_empty()) {
+                return Err(unexpected(tail));
+            }
+            cols.push(bare.to_string());
         }
     }
+    if cols.len() > 2 {
+        return Err("a structured reference names at most two columns".to_string());
+    }
     let mut it = cols.into_iter();
     let col_start = it.next();
     let col_end = it.next();
-    StructRef { table: table.to_string(), specifiers, col_start, col_end }
+    Ok(StructRef { table: table.to_string(), specifiers, col_start, col_end })
 }

crates/formula/src/printer.rs

@@ -39,12 +39,17 @@ fn anchor_a1(a: &Anchor) -> String {
 }
 
 pub fn reference_a1(r: &Reference) -> String {
+    range_a1(r, ":")
+}
+
+/// A1 text with `sep` between the two ends of a range (`:` or a trim operator).
+fn range_a1(r: &Reference, sep: &str) -> String {
     let body = match &r.kind {
         RefKind::Cell(a) => anchor_a1(a),
-        RefKind::Range(a, b) => format!("{}:{}", anchor_a1(a), anchor_a1(b)),
-        RefKind::Rows(r0, a0, r1, a1) => format!("{}{}:{}{}", if *a0 { "$" } else { "" }, r0 + 1, if *a1 { "$" } else { "" }, r1 + 1),
+        RefKind::Range(a, b) => format!("{}{sep}{}", anchor_a1(a), anchor_a1(b)),
+        RefKind::Rows(r0, a0, r1, a1) => format!("{}{}{sep}{}{}", if *a0 { "$" } else { "" }, r0 + 1, if *a1 { "$" } else { "" }, r1 + 1),
         RefKind::Cols(c0, a0, c1, a1) => {
-            format!("{}{}:{}{}", if *a0 { "$" } else { "" }, col_to_letters(*c0), if *a1 { "$" } else { "" }, col_to_letters(*c1))
+            format!("{}{}{sep}{}{}", if *a0 { "$" } else { "" }, col_to_letters(*c0), if *a1 { "$" } else { "" }, col_to_letters(*c1))
         }
     };
     format!("{}{}", sheet_prefix(&r.sheet), body)
@@ -64,22 +69,38 @@ fn anchor_r1c1(a: &Anchor, at: CellRef) -> String {
 }
 
 pub fn reference_r1c1(r: &Reference, at: CellRef) -> String {
+    range_r1c1(r, at, ":")
+}
+
+/// R1C1 text with `sep` between the two ends of a range; a trim operator never collapses
+/// `R1:R1` to `R1`.
+fn range_r1c1(r: &Reference, at: CellRef, sep: &str) -> String {
     let body = match &r.kind {
         RefKind::Cell(a) => anchor_r1c1(a, at),
-        RefKind::Range(a, b) => format!("{}:{}", anchor_r1c1(a, at), anchor_r1c1(b, at)),
+        RefKind::Range(a, b) => format!("{}{sep}{}", anchor_r1c1(a, at), anchor_r1c1(b, at)),
         RefKind::Rows(r0, a0, r1, a1) => {
             let (x, y) = (r1c1_part('R', *r0, *a0, at.row), r1c1_part('R', *r1, *a1, at.row));
-            if x == y { x } else { format!("{x}:{y}") }
+            if x == y && sep == ":" { x } else { format!("{x}{sep}{y}") }
         }
         RefKind::Cols(c0, a0, c1, a1) => {
             let (x, y) = (r1c1_part('C', *c0, *a0, at.col), r1c1_part('C', *c1, *a1, at.col));
-            if x == y { x } else { format!("{x}:{y}") }
+            if x == y && sep == ":" { x } else { format!("{x}{sep}{y}") }
         }
     };
     format!("{}{}", sheet_prefix(&r.sheet), body)
 }
 
 pub fn struct_ref(s: &StructRef) -> String {
+    write_struct_ref(s, true)
+}
+
+/// Structured reference as files spell it: `[@Col]` is only Excel's display shorthand, files
+/// hold `[[#This Row],[Col]]` (and `[#This Row]` for `[@]`).
+pub fn struct_ref_file(s: &StructRef) -> String {
+    write_struct_ref(s, false)
+}
+
+fn write_struct_ref(s: &StructRef, at_shorthand: bool) -> String {
     let esc = |c: &str| c.replace('\'', "''").replace('[', "'[").replace(']', "']").replace('#', "'#");
     let item = |i: &StructItem| match i {
         StructItem::All => "#All",
@@ -88,7 +109,7 @@ pub fn struct_ref(s: &StructRef) -> String {
         StructItem::Totals => "#Totals",
         StructItem::ThisRow => "#This Row",
     };
-    let this_row = s.specifiers == [StructItem::ThisRow];
+    let this_row = at_shorthand && s.specifiers == [StructItem::ThisRow];
     let mut out = s.table.clone();
     let simple_col = |c: &str| !c.chars().any(|ch| matches!(ch, ' ' | '[' | ']' | '#' | '\'' | ',' | ':'));
     match (&s.col_start, &s.col_end) {
@@ -98,7 +119,12 @@ pub fn struct_ref(s: &StructRef) -> String {
             let _ = write!(out, "[{}]", s.specifiers.first().map(item).unwrap_or(""));
         }
         (Some(c), None) if s.specifiers.is_empty() => {
-            let _ = write!(out, "[{}]", esc(c));
+            // Excel writes a name with spaces at its edges in the double-bracket form.
+            if c.trim() == c {
+                let _ = write!(out, "[{}]", esc(c));
+            } else {
+                let _ = write!(out, "[[{}]]", esc(c));
+            }
         }
         (Some(c), None) if this_row => {
             if simple_col(c) {
@@ -167,7 +193,15 @@ fn write_expr(s: &mut String, e: &Expr, r1c1: Option<CellRef>) {
             Some(at) => s.push_str(&reference_r1c1(r, at)),
             None => s.push_str(&reference_a1(r)),
         },
-        Expr::Name(n) => s.push_str(n),
+        Expr::Name(n) => match n.rsplit_once('!') {
+            // A sheet-qualified name is stored with the bare sheet name (`My Sheet!Total`): quote it so it parses back.
+            Some((sheet, name)) => {
+                s.push_str(&quote_sheet(sheet));
+                s.push('!');
+                s.push_str(name);
+            }
+            _ => s.push_str(n),
+        },
         Expr::Struct(st) => s.push_str(&struct_ref(st)),
         Expr::Unary(op, x) => match op {
             UnOp::Neg => {
@@ -193,11 +227,40 @@ fn write_expr(s: &mut String, e: &Expr, r1c1: Option<CellRef>) {
                     s.push('#');
                 }
             }
+            UnOp::Trim(mode) => match &**x {
+                Expr::Ref(r) if !matches!(r.kind, RefKind::Cell(_)) => match r1c1 {
+                    Some(at) => s.push_str(&range_r1c1(r, at, mode.symbol())),
+                    None => s.push_str(&range_a1(r, mode.symbol())),
+                },
+                Expr::Binary(BinOp::Range, a, b) => {
+                    write_expr(s, a, r1c1);
+                    s.push_str(mode.symbol());
+                    write_expr(s, b, r1c1);
+                }
+                // A reference that became #REF! stays `#REF!`.
+                Expr::Error(_) => write_expr(s, x, r1c1),
+                // No operator form (e.g. a range shrunk to one cell): the equivalent call.
+                other => {
+                    s.push_str("TRIMRANGE(");
+                    write_expr(s, other, r1c1);
+                    let _ = write!(s, ",{0},{0})", mode.code());
+                }
+            },
         },
-        Expr::Binary(op, a, b) => {
-            write_expr(s, a, r1c1);
-            s.push_str(op.symbol());
-            write_expr(s, b, r1c1);
+        Expr::Binary(..) => {
+            // Walk the left spine iteratively: a flat chain such as `1+1+1+...` parses into a
+            // tree one level deeper per operator, and recursing on it could exhaust the stack.
+            let mut rest: Vec<(&BinOp, &Expr)> = Vec::new();
+            let mut first = e;
+            while let Expr::Binary(op, a, b) = first {
+                rest.push((op, b));
+                first = a;
+            }
+            write_expr(s, first, r1c1);
+            for (op, right) in rest.into_iter().rev() {
+                s.push_str(op.symbol());
+                write_expr(s, right, r1c1);
+            }
         }
         Expr::Call(name, args) => {
             s.push_str(name);

crates/formula/src/tests.rs

@@ -5,6 +5,29 @@ fn rt(src: &str) -> String {
     print(&parse(src).unwrap_or_else(|e| panic!("{src}: {e}")))
 }
 
+#[test]
+fn quoted_sheet_qualified_name_keeps_quotes() {
+    assert_eq!(rt("'My Sheet'!Total"), "'My Sheet'!Total");
+    assert_eq!(rt("'Data'!Total"), "Data!Total");
+    assert_eq!(rt("'It''s'!Total+1"), "'It''s'!Total+1");
+}
+
+#[test]
+fn intersection_with_deleted_operand_reparses() {
+    // Deleting the columns of an intersection operand prints `A1:B2 #REF!`; that text must parse back.
+    assert_eq!(rt("A1:B2 #REF!"), "A1:B2 #REF!");
+    assert_eq!(rt("#REF! A1:B2"), "#REF! A1:B2");
+    assert_eq!(parse("A1:B2 #REF!"), parse("A1:B2 (#REF!)").map(|e| strip_paren(&e)));
+}
+
+fn strip_paren(e: &Expr) -> Expr {
+    match e {
+        Expr::Binary(op, a, b) => Expr::Binary(*op, Box::new(strip_paren(a)), Box::new(strip_paren(b))),
+        Expr::Paren(x) => strip_paren(x),
+        other => other.clone(),
+    }
+}
+
 #[test]
 fn roundtrips() {
     for f in [
@@ -48,6 +71,8 @@ fn normalises() {
     assert_eq!(rt("=sum(a1:b2)"), "SUM(A1:B2)");
     assert_eq!(rt("= 1 + 2"), "1+2");
     assert_eq!(rt("_xlfn.XLOOKUP(1,A:A,B:B)"), "XLOOKUP(1,A:A,B:B)");
+    assert_eq!(rt("_xlfn.GROUPBY(A1:A3,B1:B3,_xleta.SUM)"), "GROUPBY(A1:A3,B1:B3,SUM)");
+    assert_eq!(rt("_XLUDF.concat(\"a\",\"b\")"), "_xludf.CONCAT(\"a\",\"b\")");
     assert_eq!(rt("true"), "TRUE");
     assert_eq!(rt("'Sheet1'!A1"), "Sheet1!A1");
 }
@@ -183,6 +208,10 @@ fn rename_sheet_updates_qualified_names() {
     assert_eq!(print(&rename_sheet(e, "data", "Numbers")), "Numbers!MyName+MyName+Other!MyName");
     let e = parse("Data!MyName").unwrap();
     assert_eq!(print(&rename_sheet(e, "Data", "New Name")), "'New Name'!MyName");
+    // Stored bare, like a parsed name, so the evaluator finds the sheet and a second rename still matches.
+    let e = rename_sheet(parse("Data!MyName").unwrap(), "Data", "It's");
+    assert_eq!(e, Expr::Name("It's!MyName".into()));
+    assert_eq!(print(&rename_sheet(e, "It's", "Totals")), "Totals!MyName");
 }
 
 #[test]
@@ -220,3 +249,120 @@ fn spans() {
     let a1 = toks.iter().find(|t| t.tok == lexer::Tok::Word("A1".into())).unwrap();
     assert_eq!((a1.start, a1.end), (4, 6));
 }
+
+#[test]
+fn unbracketed_this_row_column() {
+    // Writers such as xlsxwriter spell `[@Units]` as `[[#This Row],Units]`.
+    let p = |f: &str| parse(f).unwrap_or_else(|e| panic!("{f}: {e}"));
+    let Expr::Binary(BinOp::Mul, a, _) = p("[[#This Row],Units]*[[#This Row],Price]") else { panic!() };
+    let Expr::Struct(s) = *a else { panic!() };
+    assert_eq!((s.specifiers.as_slice(), s.col_start.as_deref()), ([StructItem::ThisRow].as_slice(), Some("Units")));
+    assert_eq!(rt("[[#This Row],Units]*[[#This Row],Price]"), "[@Units]*[@Price]");
+    assert_eq!(rt("Sales[[#This Row],Units]"), "Sales[@Units]");
+    assert_eq!(rt("Sales[[#This Row], Units ]"), "Sales[@Units]");
+    assert_eq!(rt("[[#This Row],Units]+[@[Unit Price]]+Sales[[#This Row],[Qty]]"), "[@Units]+[@[Unit Price]]+Sales[@Qty]");
+    // Unexpected text between the brackets is an error, never silently dropped.
+    for bad in [
+        "[[#This Row]x]",
+        "[[#This Row],[A]]x",
+        "[[#Data],Col]",
+        "[[#This Row],A:B]",
+        "[x[#This Row]]",
+        "[[#This Row],]x",
+        "Sales[[#All],[A]]junk",
+        "Sales[[A],[B],[C]]",
+        "Sales[@[A]x]",
+    ] {
+        assert!(parse(bad).is_err(), "{bad} should fail");
+    }
+}
+
+#[test]
+fn struct_column_keeps_edge_spaces() {
+    // The spaces are part of the column name: `Table1[Qty ]` names `Qty `, never `Qty`.
+    let Expr::Struct(s) = parse("Table1[Qty ]").unwrap() else { panic!() };
+    assert_eq!(s.col_start.as_deref(), Some("Qty "));
+    let Expr::Struct(s) = parse("Table1[ Qty]").unwrap() else { panic!() };
+    assert_eq!(s.col_start.as_deref(), Some(" Qty"));
+    // Excel writes such a column in the double-bracket form.
+    assert_eq!(rt("Table1[Qty ]"), "Table1[[Qty ]]");
+    for f in ["Table1[[Qty ]]", "Table1[[ Sum for Q2 ]]", "Table1[[#Totals],[Qty ]]", "Table1[@[Qty ]]", "Table1[Unit Price]"] {
+        assert_eq!(rt(f), f);
+    }
+}
+
+#[test]
+fn trim_references() {
+    for f in [
+        "SUM(A1:.E10)",
+        "SUM(A1.:E10)",
+        "SUM(A1.:.E10)",
+        "SUM(A:.A)",
+        "SUM($A.:.$C)",
+        "ROWS(1:.5)",
+        "ROWS($1.:$5)",
+        "ROWS(1.:.5)",
+        "Sheet2!$A$1:.B9",
+        "Q1.2026!A1.:.B2",
+        "'Q1 2026'!A1:.B2",
+        "SUM(A1:.A9,B1.:B9)",
+        "A1:.A9*2",
+    ] {
+        assert_eq!(rt(f), f, "round trip of {f}");
+    }
+    let Expr::Call(_, args) = parse("SUM(A1:.E10)").unwrap() else { panic!() };
+    assert!(matches!(args.as_slice(), [Expr::Unary(UnOp::Trim(TrimMode::Trailing), r)] if matches!(**r, Expr::Ref(_))));
+    // Decimals, row ranges and dotted names keep their meaning.
+    assert_eq!(parse("1.5+.5").unwrap(), Expr::Binary(BinOp::Add, Box::new(Expr::Number(1.5)), Box::new(Expr::Number(0.5))));
+    for f in ["SUM(1:5)", "Q1.2026!A1:B2", "my.name+1", "SUM(A1:B2)*1.5", "1.:5"] {
+        assert_eq!(rt(f), f);
+    }
+    assert_eq!(rt("'Q1.2026'!A1:B2"), "Q1.2026!A1:B2");
+    assert!(matches!(parse("Q1.2026!A1:B2").unwrap(), Expr::Ref(_)));
+    // File call forms.
+    assert_eq!(rt("SUM(_xlfn._TRO_TRAILING(A1:E10))"), "SUM(A1:.E10)");
+    assert_eq!(rt("_xlfn._TRO_LEADING(A:A)"), "A.:A");
+    assert_eq!(rt("_xlfn._TRO_ALL(Sheet1!A1:B2)"), "Sheet1!A1.:.B2");
+    // Not a range: printed as the equivalent call.
+    assert_eq!(rt("_xlfn._TRO_ALL(B2)"), "TRIMRANGE(B2,3,3)");
+    for bad in ["A1.:", ".:A1", "A1:.:B2", "A1.:.:B2"] {
+        assert!(parse(bad).is_err(), "{bad} should fail");
+    }
+    // R1C1 keeps the operator.
+    assert_eq!(print_r1c1(&parse("SUM(A1:.B2)+ROWS(2.:2)").unwrap(), gridcraft_core::CellRef::new(0, 0)), "SUM(RC:.R[1]C[1])+ROWS(R[1].:R[1])");
+}
+
+#[test]
+fn trim_references_adjust() {
+    let ins = Edit::Insert { axis: Axis::Rows, at: 2, count: 2 };
+    let e = parse("SUM(A1:.A5)+SUM(B:.B)+ROWS(2.:.4)").unwrap();
+    assert_eq!(print(&adjust(e, "S", "S", &ins)), "SUM(A1:.A7)+SUM(B:.B)+ROWS(2.:.6)");
+    let del = Edit::Delete { axis: Axis::Cols, at: 0, count: 1 };
+    let e = parse("SUM(A1.:C1)+SUM(A:.A)").unwrap();
+    assert_eq!(print(&adjust(e, "S", "S", &del)), "SUM(A1.:B1)+SUM(#REF!)");
+    assert_eq!(print(&shift_relative(parse("SUM(A1.:.B2)").unwrap(), 1, 1)), "SUM(B2.:.C3)");
+    let refs: Vec<String> = parse("SUM(Sheet2!A1:.B5)").unwrap().references().iter().map(|r| printer::reference_a1(r)).collect();
+    assert_eq!(refs, ["Sheet2!A1:B5"]);
+}
+
+#[test]
+fn prints_long_flat_chain_without_deep_recursion() {
+    // Small stack: a recursive printer overflows long before 20000 levels.
+    let handle = std::thread::Builder::new()
+        .stack_size(256 * 1024)
+        .spawn(|| {
+            let mut e = Expr::Number(1.0);
+            for _ in 0..20000 {
+                e = Expr::Binary(BinOp::Add, Box::new(e), Box::new(Expr::Number(1.0)));
+            }
+            let text = print(&e);
+            let r1c1 = print_r1c1(&e, gridcraft_core::CellRef { row: 0, col: 0 });
+            // Dropping the deep tree recurses; leak it so only the printer is under test.
+            std::mem::forget(e);
+            (text, r1c1)
+        })
+        .expect("spawn");
+    let (text, r1c1) = handle.join().expect("printer must not overflow the stack");
+    assert_eq!(text, vec!["1"; 20001].join("+"));
+    assert_eq!(r1c1, text);
+}

crates/functions/src/criteria.rs

@@ -5,6 +5,10 @@ use std::cmp::Ordering;
 use gridcraft_core::parse::parse_number_text;
 use gridcraft_core::{CellError, Value, compare_numbers, compare_text};
 
+/// Longest text criterion COUNTIF and its relatives accept, in UTF-16 code units as Excel
+/// counts them (😀 is two units); a longer one is `#VALUE!`.
+const MAX_CRITERION_UTF16_UNITS: usize = 255;
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum Op {
     Eq,
@@ -22,6 +26,15 @@ enum Operand {
     Error(CellError),
     /// Text (lower-cased chars kept for wildcard matching).
     Text(String),
+    /// A criterion cut to its first 255 UTF-16 units in the middle of a surrogate pair: the
+    /// complete characters before the cut, followed (in Excel) by a lone high surrogate.
+    ///
+    /// No cell text holds a lone surrogate, so `=` matches nothing and `<>` everything, as
+    /// Excel gives 0 for SUMIFS with a criterion of 128 emoji. For `<`, `<=`, `>` and `>=` the
+    /// criterion sorts just above the kept text: a cell matches `>`/`>=` when it sorts above
+    /// that text, and `<`/`<=` otherwise. This is an approximation (Excel wasn't checked) and
+    /// only matters for comparison criteria over 255 units.
+    CutText(String),
     /// Nothing after the operator (`"="`, `"<>"`) or an empty criterion.
     Blank,
 }
@@ -48,25 +61,52 @@ impl Criterion {
         }
     }
 
-    fn parse_text(t: &str) -> Criterion {
-        let (op, rest) = if let Some(r) = t.strip_prefix(">=") {
-            (Op::Ge, r)
-        } else if let Some(r) = t.strip_prefix("<=") {
-            (Op::Le, r)
-        } else if let Some(r) = t.strip_prefix("<>") {
-            (Op::Ne, r)
-        } else if let Some(r) = t.strip_prefix('=') {
-            (Op::Eq, r)
-        } else if let Some(r) = t.strip_prefix('>') {
-            (Op::Gt, r)
-        } else if let Some(r) = t.strip_prefix('<') {
-            (Op::Lt, r)
-        } else {
-            if t.is_empty() {
-                return Criterion { op: Op::Eq, operand: Operand::Blank, bare_empty: true };
+    /// Parses the criteria argument of COUNTIF, SUMIF, AVERAGEIF and the single-pair *IFS
+    /// functions: like `parse`, but text longer than 255 UTF-16 code units is `#VALUE!`, as in
+    /// Excel (checked on Excel 2016 and Microsoft 365: `"a"×254 & "😀"` is 255 characters but
+    /// 256 units, and is `#VALUE!`).
+    pub(crate) fn parse_arg(v: &Value) -> Result<Criterion, CellError> {
+        match v {
+            Value::Array(a) => Criterion::parse_arg(a.data.first().unwrap_or(&Value::Empty)),
+            // A UTF-8 string has at least as many bytes as UTF-16 units, so short text skips the count.
+            Value::Text(t) if t.len() > MAX_CRITERION_UTF16_UNITS && t.encode_utf16().nth(MAX_CRITERION_UTF16_UNITS).is_some() => {
+                Err(CellError::Value)
             }
-            (Op::Eq, t)
-        };
+            other => Ok(Criterion::parse(other)),
+        }
+    }
+
+    /// Parses a criteria argument of an *IFS function with two or more criteria pairs. Excel
+    /// doesn't reject a longer text criterion there: it matches its first 255 UTF-16 code units
+    /// (checked on Excel 2016 and Microsoft 365 with COUNTIFS, SUMIFS, AVERAGEIFS, MAXIFS and
+    /// MINIFS). A cut through a surrogate pair matches nothing; see `Operand::CutText`.
+    pub(crate) fn parse_arg_truncated(v: &Value) -> Criterion {
+        match v {
+            Value::Array(a) => Criterion::parse_arg_truncated(a.data.first().unwrap_or(&Value::Empty)),
+            Value::Text(t) if t.len() > MAX_CRITERION_UTF16_UNITS => {
+                let mut units = 0;
+                for (i, c) in t.char_indices() {
+                    if units + c.len_utf16() > MAX_CRITERION_UTF16_UNITS {
+                        if units == MAX_CRITERION_UTF16_UNITS {
+                            return Criterion::parse_text(&t[..i]);
+                        }
+                        // The cut falls between the two halves of `c`.
+                        let (op, rest) = split_op(&t[..i]);
+                        return Criterion { op, operand: Operand::CutText(rest.to_string()), bare_empty: false };
+                    }
+                    units += c.len_utf16();
+                }
+                Criterion::parse_text(t)
+            }
+            other => Criterion::parse(other),
+        }
+    }
+
+    fn parse_text(t: &str) -> Criterion {
+        if t.is_empty() {
+            return Criterion { op: Op::Eq, operand: Operand::Blank, bare_empty: true };
+        }
+        let (op, rest) = split_op(t);
         let operand = if rest.is_empty() {
             Operand::Blank
         } else if let Some(n) = parse_number_text(rest) {
@@ -98,9 +138,10 @@ impl Criterion {
                 match self.op {
                     Op::Eq => blank,
                     Op::Ne => !blank,
-                    // "<" / ">" with nothing: Excel compares against "" for text cells.
+                    // "<" / ">" with nothing: Excel compares against "" for text cells, but an
+                    // empty string never matches ("<=" and ">=" count it in neither).
                     _ => match &v {
-                        Value::Text(t) => cmp_op(self.op, compare_text(t, "")),
+                        Value::Text(t) if !t.is_empty() => cmp_op(self.op, compare_text(t, "")),
                         _ => false,
                     },
                 }
@@ -140,10 +181,35 @@ impl Criterion {
                     _ => false,
                 },
             },
+            Operand::CutText(kept) => match self.op {
+                Op::Eq => false,
+                Op::Ne => true,
+                Op::Lt | Op::Le => matches!(&v, Value::Text(t) if compare_text(t, kept) != Ordering::Greater),
+                Op::Gt | Op::Ge => matches!(&v, Value::Text(t) if compare_text(t, kept) == Ordering::Greater),
+            },
         }
     }
 }
 
+/// Splits a leading comparison operator (`=` when there is none) off a text criterion.
+fn split_op(t: &str) -> (Op, &str) {
+    if let Some(r) = t.strip_prefix(">=") {
+        (Op::Ge, r)
+    } else if let Some(r) = t.strip_prefix("<=") {
+        (Op::Le, r)
+    } else if let Some(r) = t.strip_prefix("<>") {
+        (Op::Ne, r)
+    } else if let Some(r) = t.strip_prefix('=') {
+        (Op::Eq, r)
+    } else if let Some(r) = t.strip_prefix('>') {
+        (Op::Gt, r)
+    } else if let Some(r) = t.strip_prefix('<') {
+        (Op::Lt, r)
+    } else {
+        (Op::Eq, t)
+    }
+}
+
 fn cmp_op(op: Op, o: Ordering) -> bool {
     match op {
         Op::Eq => o == Ordering::Equal,
@@ -168,19 +234,25 @@ fn tokenize(pattern: &str) -> Vec<Tok> {
     while let Some(c) = it.next() {
         match c {
             '~' => match it.next() {
-                Some(n) => out.extend(n.to_lowercase().map(Tok::Char)),
+                Some(n) => out.extend(std::iter::once(lower_char(n)).map(Tok::Char)),
                 None => out.push(Tok::Char('~')),
             },
             '*' => out.push(Tok::Star),
             '?' => out.push(Tok::Any),
-            c => out.extend(c.to_lowercase().map(Tok::Char)),
+            c => out.extend(std::iter::once(lower_char(c)).map(Tok::Char)),
         }
     }
     out
 }
 
+/// Lowercase one char to exactly one char, so positions in the lowered text match the original
+/// (U+0130 `İ` folds to `i`, like `fold` in text.rs).
+fn lower_char(c: char) -> char {
+    c.to_lowercase().next().unwrap_or(c)
+}
+
 fn lower_chars(s: &str) -> Vec<char> {
-    s.chars().flat_map(char::to_lowercase).collect()
+    s.chars().map(lower_char).collect()
 }
 
 /// Whether the pattern contains an unescaped wildcard.
@@ -290,6 +362,9 @@ mod tests {
         assert!(m("<>", Value::from("a")));
         assert!(!m("<>", Value::Empty));
         assert!(m("TRUE", Value::Bool(true)));
+        // A bare "<=" or ">=" never matches an empty string (Excel 365: COUNTIF(="", "<=") is 0).
+        assert!(!m("<=", Value::from("")));
+        assert!(!m(">=", Value::from("")));
         assert!(m("<b", Value::from("apple")));
         assert!(!m("<b", Value::Number(1.0)));
         assert!(m("#N/A", Value::Error(CellError::NA)));
@@ -317,6 +392,8 @@ mod tests {
         assert_eq!(wildcard_find("b?d", "abxxd bcd", 0), Some(6));
         assert_eq!(wildcard_find("c*", "abcd", 0), Some(2));
         assert_eq!(wildcard_find("z", "abcd", 0), None);
+        assert_eq!(wildcard_find("b", "a\u{130}bc", 0), Some(2));
+        assert!(wildcard_match("i*", "\u{130}stanbul"));
         assert!(has_wildcards("a*"));
         assert!(!has_wildcards("abc"));
     }

crates/functions/src/database.rs

@@ -4,7 +4,9 @@
 //! The database and the criteria are arrays whose first row holds column labels. Each criteria
 //! row is a set of conditions that must all hold (AND); a record matches when any criteria row
 //! holds (OR). An empty criteria cell matches anything. Plain text conditions match values that
-//! begin with the text, as in Excel's advanced filter.
+//! begin with the text, as in Excel's advanced filter, so an empty string matches any text. A
+//! formula under a label that names no field is a computed criterion, which the host evaluates
+//! for each record ([`Ctx::computed_criterion`]).
 
 use std::borrow::Cow;
 
@@ -49,7 +51,6 @@ fn field_index(db: &Array, a: &[Arg]) -> R<Option<usize>> {
 fn cell_criterion(v: &Value) -> Option<Criterion> {
     match v {
         Value::Empty => None,
-        Value::Text(t) if t.is_empty() => None,
         Value::Text(t) => {
             let s: &str = t;
             let has_op = s.starts_with(['=', '<', '>']);
@@ -65,9 +66,10 @@ fn cell_criterion(v: &Value) -> Option<Criterion> {
 }
 
 /// Rows (1-based within the database, excluding the header) of matching records.
-fn matching_records(db: &Array, crit: &Array) -> Vec<usize> {
-    // Per criteria row: list of (database column or None when the label is unknown, criterion).
-    let mut rows: Vec<Vec<(Option<usize>, Criterion)>> = Vec::new();
+fn matching_records(db: &Array, crit: &Array, ctx: &mut dyn Ctx) -> Vec<usize> {
+    // Per criteria row: its index and a list of (criteria column, database column or None when
+    // the label is unknown, criterion).
+    let mut rows: Vec<(usize, Vec<(usize, Option<usize>, Criterion)>)> = Vec::new();
     for r in 1..crit.rows {
         let mut conds = Vec::new();
         for c in 0..crit.cols {
@@ -78,18 +80,20 @@ fn matching_records(db: &Array, crit: &Array) -> Vec<usize> {
                 Some(Value::Number(n)) => find_column(db, &gridcraft_core::number_to_text(*n)),
                 _ => None,
             };
-            conds.push((col, cr));
+            conds.push((c, col, cr));
         }
-        rows.push(conds);
+        rows.push((r, conds));
     }
     let all_match = rows.is_empty();
     (1..db.rows)
-        .filter(|&r| {
+        .filter(|&rec| {
             all_match
-                || rows.iter().any(|conds| {
-                    conds.iter().all(|(col, cr)| match col {
-                        Some(c) => cr.matches(db.get(r, *c).unwrap_or(&Value::Empty)),
-                        None => false,
+                || rows.iter().any(|(r, conds)| {
+                    conds.iter().all(|(c, col, cr)| match col {
+                        Some(f) => cr.matches(db.get(rec, *f).unwrap_or(&Value::Empty)),
+                        // Under a label that names no field, only a formula (a computed
+                        // criterion) can hold.
+                        None => ctx.computed_criterion(*r, *c, db, rec).unwrap_or(false),
                     })
                 })
         })
@@ -102,7 +106,7 @@ struct Selection<'a> {
     records: Vec<usize>,
 }
 
-fn select(a: &[Arg]) -> R<Selection<'_>> {
+fn select<'a>(a: &'a [Arg], ctx: &mut dyn Ctx) -> R<Selection<'a>> {
     let dbv = &a.first().ok_or(CellError::Value)?.value;
     let critv = &a.get(2).ok_or(CellError::Value)?.value;
     if let Value::Error(e) = dbv {
@@ -114,31 +118,31 @@ fn select(a: &[Arg]) -> R<Selection<'_>> {
     let db = as_array(dbv);
     let crit = as_array(critv);
     let field = field_index(&db, a)?;
-    let records = matching_records(&db, &crit);
+    let records = matching_records(&db, &crit, ctx);
     Ok(Selection { db, field, records })
 }
 
 /// Numbers of the field among matching records (field required).
-fn field_numbers(a: &[Arg]) -> R<Vec<f64>> {
-    let s = select(a)?;
+fn field_numbers(a: &[Arg], c: &mut dyn Ctx) -> R<Vec<f64>> {
+    let s = select(a, c)?;
     let f = s.field.ok_or(CellError::Value)?;
     Ok(s.records.iter().filter_map(|&r| s.db.get(r, f).and_then(Value::as_f64)).collect())
 }
 
-fn dsum(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    num_val(field_numbers(a)?.iter().sum())
+fn dsum(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    num_val(field_numbers(a, c)?.iter().sum())
 }
 
-fn daverage(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let v = field_numbers(a)?;
+fn daverage(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let v = field_numbers(a, c)?;
     if v.is_empty() {
         return Err(CellError::Div0);
     }
     num_val(v.iter().sum::<f64>() / v.len() as f64)
 }
 
-fn dcount(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let s = select(a)?;
+fn dcount(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let s = select(a, c)?;
     let n = match s.field {
         Some(f) => s.records.iter().filter(|&&r| matches!(s.db.get(r, f), Some(Value::Number(_)))).count(),
         None => s.records.len(),
@@ -146,8 +150,8 @@ fn dcount(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     num_val(n as f64)
 }
 
-fn dcounta(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let s = select(a)?;
+fn dcounta(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let s = select(a, c)?;
     let n = match s.field {
         Some(f) => s.records.iter().filter(|&&r| !matches!(s.db.get(r, f), None | Some(Value::Empty))).count(),
         None => s.records.len(),
@@ -155,28 +159,31 @@ fn dcounta(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     num_val(n as f64)
 }
 
-fn dget(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let s = select(a)?;
+fn dget(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let s = select(a, c)?;
     let f = s.field.ok_or(CellError::Value)?;
-    match s.records.as_slice() {
-        [] => Err(CellError::Value),
-        [r] => Ok(s.db.get(*r, f).cloned().unwrap_or(Value::Empty)),
+    // Records whose field is blank (or "") don't count, as in Excel.
+    let mut found =
+        s.records.iter().filter_map(|&r| s.db.get(r, f)).filter(|v| !matches!(v, Value::Empty) && !matches!(v, Value::Text(t) if t.is_empty()));
+    match (found.next(), found.next()) {
+        (None, _) => Err(CellError::Value),
+        (Some(v), None) => Ok(v.clone()),
         _ => Err(CellError::Num),
     }
 }
 
-fn dmax(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let v = field_numbers(a)?;
+fn dmax(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let v = field_numbers(a, c)?;
     num_val(v.iter().copied().reduce(f64::max).unwrap_or(0.0))
 }
 
-fn dmin(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let v = field_numbers(a)?;
+fn dmin(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let v = field_numbers(a, c)?;
     num_val(v.iter().copied().reduce(f64::min).unwrap_or(0.0))
 }
 
-fn dproduct(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let v = field_numbers(a)?;
+fn dproduct(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    let v = field_numbers(a, c)?;
     if v.is_empty() {
         return num_val(0.0);
     }
@@ -194,20 +201,20 @@ fn variance(v: &[f64], sample: bool) -> R<f64> {
     Ok(ss / if sample { n - 1.0 } else { n })
 }
 
-fn dvar(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    num_val(variance(&field_numbers(a)?, true)?)
+fn dvar(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    num_val(variance(&field_numbers(a, c)?, true)?)
 }
 
-fn dvarp(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    num_val(variance(&field_numbers(a)?, false)?)
+fn dvarp(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    num_val(variance(&field_numbers(a, c)?, false)?)
 }
 
-fn dstdev(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    num_val(variance(&field_numbers(a)?, true)?.sqrt())
+fn dstdev(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    num_val(variance(&field_numbers(a, c)?, true)?.sqrt())
 }
 
-fn dstdevp(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    num_val(variance(&field_numbers(a)?, false)?.sqrt())
+fn dstdevp(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
+    num_val(variance(&field_numbers(a, c)?, false)?.sqrt())
 }
 
 pub(crate) fn specs() -> Vec<FnSpec> {
@@ -371,4 +378,69 @@ mod tests {
         is_err(ev("DSUM", vec![e(CellError::Ref), t("Yield"), rf(c("=Cherry"))]), CellError::Ref);
         close(ev("DCOUNTA", vec![rf(db()), empty(), rf(c("=Pear"))]), 2.0);
     }
+
+    /// Expected results are Excel's, from Apache POI's `DGet.xls` (rows 74-86).
+    #[test]
+    fn empty_string_criterion() {
+        let db = arr(vec![
+            vec![tv("Index"), tv("Value")],
+            vec![tv("a"), tv("=")],
+            vec![tv("b"), Value::Empty],
+            vec![tv("c"), tv("")],
+            vec![tv("d"), tv(" ")],
+            vec![tv("f"), Value::Error(CellError::Value)],
+            vec![tv("h"), tv("abc")],
+            vec![tv("i"), nv(0.0)],
+        ]);
+        let get = |index: &str| {
+            let crit = arr(vec![vec![tv("Index"), tv("Value")], vec![tv(index), tv("")]]);
+            ev("DGET", vec![rf(db.clone()), t("Index"), rf(crit)])
+        };
+        // Like any plain text, "" is a "begins with" pattern: it matches every text value.
+        is_text(get("c"), "c");
+        is_text(get("h"), "h");
+        is_err(get("b"), CellError::Value);
+        is_err(get("i"), CellError::Value);
+        is_err(get("f"), CellError::Value);
+        let all = arr(vec![vec![tv("Value")], vec![tv("")]]);
+        close(ev("DCOUNTA", vec![rf(db.clone()), t("Index"), rf(all)]), 4.0);
+
+        // Under a label that names no field, "" is a condition that never holds.
+        let db = arr(vec![vec![tv("One"), tv("Two"), tv("Three")], vec![tv("a"), tv("c"), tv("x")], vec![tv("b"), tv("d"), tv("y")]]);
+        let get = |label: Value, value: Value| {
+            let crit = arr(vec![vec![tv("One"), label, tv("Three")], vec![tv("a"), value, tv("x")]]);
+            ev("DGET", vec![rf(db.clone()), t("One"), rf(crit)])
+        };
+        is_text(get(Value::Empty, Value::Empty), "a");
+        is_text(get(tv(""), Value::Empty), "a");
+        is_err(get(Value::Empty, tv("")), CellError::Value);
+        is_err(get(tv(""), tv("")), CellError::Value);
+    }
+
+    /// Expected results are Excel's, from Apache POI's `DGet.xls` (rows 108-119).
+    #[test]
+    fn dget_skips_empty_fields() {
+        let db = arr(vec![
+            vec![tv("One"), tv("Two")],
+            vec![tv("a"), Value::Empty],
+            vec![tv("b"), tv(" ")],
+            vec![tv("c"), tv("")],
+            vec![tv("d"), Value::Error(CellError::NA)],
+            vec![tv("j"), Value::Empty],
+            vec![tv("j"), tv("Text")],
+            vec![tv("j"), Value::Empty],
+            vec![tv("k"), Value::Empty],
+            vec![tv("k"), tv("")],
+        ]);
+        let get = |one: &str| {
+            let crit = arr(vec![vec![tv("One")], vec![tv(one)]]);
+            ev("DGET", vec![rf(db.clone()), t("Two"), rf(crit)])
+        };
+        is_err(get("a"), CellError::Value);
+        is_text(get("b"), " ");
+        is_err(get("c"), CellError::Value);
+        is_err(get("d"), CellError::NA);
+        is_text(get("j"), "Text");
+        is_err(get("k"), CellError::Value);
+    }
 }

crates/functions/src/date.rs

@@ -1,6 +1,6 @@
 //! Date and time functions.
 
-use gridcraft_core::date::{DateTime, datetime_from_serial, days_in_month, days_in_month_in, is_leap, serial_from_ymd};
+use gridcraft_core::date::{DateTime, datetime_from_serial, days_in_month, is_leap, serial_from_ymd, serial_in_system};
 use gridcraft_core::parse::parse_input;
 use gridcraft_core::{CellError, DateSystem, Value};
 
@@ -98,10 +98,10 @@ fn second(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 }
 
 fn now(_a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
-    num_val(c.now_serial())
+    num_val(serial_in_system(c.date_system(), c.now_serial()))
 }
 fn today(_a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
-    num_val(c.now_serial().floor())
+    num_val(serial_in_system(c.date_system(), c.now_serial()).floor())
 }
 
 fn weekday(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
@@ -164,7 +164,9 @@ fn edate(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
     if !(1900..=9999).contains(&y) {
         return Err(CellError::Num);
     }
-    let dd = (d.day.max(1) as i64).min(days_in_month_in(sys, y as i32, mo as u32) as i64);
+    // Excel keeps serial 0's day 0 and gives February 1900 its real 28 days here, though the
+    // sheet's calendar has a 29 February 1900 (serial 60).
+    let dd = (d.day as i64).min(days_in_month(y as i32, mo as u32) as i64);
     num_val(ymd_serial(sys, y, mo, dd)? as f64)
 }
 
@@ -177,7 +179,8 @@ fn eomonth(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
     if !(1900..=9999).contains(&y) {
         return Err(CellError::Num);
     }
-    num_val(ymd_serial(sys, y, mo, days_in_month_in(sys, y as i32, mo as u32) as i64)? as f64)
+    // Like EDATE, February 1900 ends on the 28th (serial 59).
+    num_val(ymd_serial(sys, y, mo, days_in_month(y as i32, mo as u32) as i64)? as f64)
 }
 
 fn datedif(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
@@ -496,7 +499,16 @@ pub(crate) fn specs() -> Vec<FnSpec> {
         f!("ISOWEEKNUM", 1, 1, DateTime, S, "ISOWEEKNUM(date)", "Returns the ISO 8601 week number of a date.", isoweeknum),
         f!("EDATE", 2, 2, DateTime, S, "EDATE(start_date, months)", "Returns the date a number of months before or after a date.", edate),
         f!("EOMONTH", 2, 2, DateTime, S, "EOMONTH(start_date, months)", "Returns the last day of the month a number of months away.", eomonth),
-        f!("DATEDIF", 3, 3, DateTime, S, "DATEDIF(start_date, end_date, unit)", "Counts whole years, months or days between two dates.", datedif),
+        f!(
+            "DATEDIF",
+            3,
+            3,
+            DateTime,
+            S,
+            "DATEDIF(start_date, end_date, unit)",
+            "Counts whole years, months or days between two dates. unit: Y, M, D, MD, YM or YD.",
+            datedif
+        ),
         f!("DATEVALUE", 1, 1, DateTime, S, "DATEVALUE(date_text)", "Converts a date written as text into a date serial number.", datevalue),
         f!("TIMEVALUE", 1, 1, DateTime, S, "TIMEVALUE(time_text)", "Converts a time written as text into a fraction of a day.", timevalue),
         f!("DAYS", 2, 2, DateTime, S, "DAYS(end_date, start_date)", "Returns the number of days between two dates.", days),
@@ -671,17 +683,35 @@ mod tests {
         close(ev("DATEVALUE", vec![t("2/29/1900")]), 60.0);
         close(ev("DATEVALUE", vec![t("3/1/1900")]), 61.0);
         is_err(ev("DATEVALUE", vec![t("2/29/1901")]), CellError::Value);
-        // EDATE and EOMONTH land on it as the end of February 1900.
-        close(ev("EOMONTH", vec![n(d(1900.0, 1.0, 15.0)), n(1.0)]), 60.0);
-        close(ev("EOMONTH", vec![n(60.0), n(0.0)]), 60.0);
-        close(ev("EOMONTH", vec![n(d(1900.0, 3.0, 15.0)), n(-1.0)]), 60.0);
+        // EDATE and EOMONTH read it as 29 February, but end February 1900 on the 28th.
+        close(ev("EOMONTH", vec![n(d(1900.0, 1.0, 15.0)), n(1.0)]), 59.0);
+        close(ev("EOMONTH", vec![n(60.0), n(0.0)]), 59.0);
+        close(ev("EOMONTH", vec![n(d(1900.0, 3.0, 15.0)), n(-1.0)]), 59.0);
         close(ev("EOMONTH", vec![n(60.0), n(12.0)]), d(1901.0, 2.0, 28.0));
-        close(ev("EDATE", vec![n(d(1900.0, 1.0, 31.0)), n(1.0)]), 60.0);
-        close(ev("EDATE", vec![n(d(1900.0, 3.0, 31.0)), n(-1.0)]), 60.0);
+        close(ev("EDATE", vec![n(d(1900.0, 1.0, 31.0)), n(1.0)]), 59.0);
+        close(ev("EDATE", vec![n(d(1900.0, 3.0, 31.0)), n(-1.0)]), 59.0);
         close(ev("EDATE", vec![n(60.0), n(1.0)]), d(1900.0, 3.0, 29.0));
         close(ev("EDATE", vec![n(60.0), n(12.0)]), d(1901.0, 2.0, 28.0));
     }
 
+    #[test]
+    fn edate_eomonth_early_1900() {
+        // Excel 365: serial 0 is 0 January 1900 and February 1900 has 28 days here.
+        close(ev("EDATE", vec![n(0.0), n(0.0)]), 0.0);
+        close(ev("EDATE", vec![n(0.0), n(1.0)]), 31.0);
+        close(ev("EDATE", vec![n(0.0), n(12.0)]), 366.0);
+        close(ev("EOMONTH", vec![n(0.0), n(1.0)]), 59.0);
+        close(ev("EDATE", vec![n(31.0), n(1.0)]), 59.0);
+        close(ev("EOMONTH", vec![n(59.0), n(0.0)]), 59.0);
+        // Unchanged, and the same as Excel.
+        close(ev("EOMONTH", vec![n(0.0), n(0.0)]), 31.0);
+        is_err(ev("EOMONTH", vec![n(0.0), n(-1.0)]), CellError::Num);
+        close(ev("EDATE", vec![n(59.0), n(1.0)]), 88.0);
+        close(ev("EDATE", vec![n(60.0), n(1.0)]), 89.0);
+        close(ev("EDATE", vec![n(61.0), n(-1.0)]), 32.0);
+        close(ev("EOMONTH", vec![n(31.0), n(0.0)]), 31.0);
+    }
+
     #[test]
     fn datedif_units() {
         let s = n(d(2001.0, 6.0, 1.0));
@@ -785,6 +815,11 @@ mod tests {
         close(crate::call(spec, &[n(0.0)], &mut ctx), 6.0);
         let spec = crate::lookup("YEAR").unwrap();
         close(crate::call(spec, &[n(0.0)], &mut ctx), 1904.0);
+        // The clock is 2026-10-07 12:00; in the 1904 system that is serial 44840.5.
+        close(crate::call(crate::lookup("NOW").unwrap(), &[], &mut ctx), 44840.5);
+        let today = crate::call(crate::lookup("TODAY").unwrap(), &[], &mut ctx);
+        close(today.clone(), 44840.0);
+        close(crate::call(spec, &[crate::Arg::val(today)], &mut ctx), 2026.0);
         // No fictitious day here: 1904 is a real leap year and 1900 is before the epoch.
         let spec = crate::lookup("DATE").unwrap();
         close(crate::call(spec, &[n(1904.0), n(2.0), n(29.0)], &mut ctx), 59.0);

crates/functions/src/dynamic.rs

@@ -30,6 +30,11 @@ fn rows_of(a: &Array) -> Vec<Vec<Value>> {
     (0..a.rows).map(|r| (0..a.cols).map(|c| a.get(r, c).cloned().unwrap_or(Value::Empty)).collect()).collect()
 }
 
+/// `#NUM!` when an `h` x `w` output would exceed the function cell budget.
+fn check_output_size(h: usize, w: usize) -> R<()> {
+    if h.saturating_mul(w) > MAX_CELLS { Err(CellError::Num) } else { Ok(()) }
+}
+
 /// Builds an array from rows (all rows padded to the widest with `pad`). Empty → `#CALC!`.
 fn from_rows(rows: Vec<Vec<Value>>, pad: &Value) -> R<Value> {
     let h = rows.len();
@@ -37,9 +42,7 @@ fn from_rows(rows: Vec<Vec<Value>>, pad: &Value) -> R<Value> {
     if h == 0 || w == 0 {
         return Err(CellError::Calc);
     }
-    if h.saturating_mul(w) > MAX_CELLS {
-        return Err(CellError::Num);
-    }
+    check_output_size(h, w)?;
     let mut data = Vec::with_capacity(h * w);
     for mut r in rows {
         r.resize(w, pad.clone());
@@ -321,16 +324,20 @@ fn vstack(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 fn hstack(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     let mut arrays = Vec::new();
     let mut h = 0usize;
+    let mut w = 0usize;
     let mut total = 0usize;
     for i in 0..args.len() {
         let a = arr_arg(args, i)?;
         h = h.max(a.rows);
+        w = w.saturating_add(a.cols);
         total = total.saturating_add(a.data.len());
         if total > MAX_CELLS {
             return Err(CellError::Num);
         }
         arrays.push(a);
     }
+    // The padded rectangle can be far larger than the inputs; refuse it before building any rows.
+    check_output_size(h, w)?;
     let mut rows = vec![Vec::new(); h];
     for a in &arrays {
         for (r, row) in rows.iter_mut().enumerate() {
@@ -785,6 +792,12 @@ fn groupby(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     from_rows(out, &Value::Empty)
 }
 
+/// Height and width of a PIVOTBY grid: `header_rows` (one per column field, plus the value-name row) and
+/// `body_rows` (row keys plus the total row), each `lead` row-field cells wide plus `value_cols` cells per column key.
+fn pivot_dims(header_rows: usize, body_rows: usize, col_keys: usize, value_cols: usize, lead: usize) -> (usize, usize) {
+    (header_rows.saturating_add(body_rows), col_keys.saturating_mul(value_cols).saturating_add(lead))
+}
+
 fn pivotby(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     let rf = arr_arg(args, 0)?;
     let cf = arr_arg(args, 1)?;
@@ -801,9 +814,6 @@ fn pivotby(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     let ckeys: Vec<Vec<Value>> = p.rows.iter().map(|&r| key_row(&cf, r)).collect();
     let rk = distinct_keys(&rkeys, if row_sort.unsigned_abs() as usize <= rf.cols { row_sort } else { 0 });
     let ck = distinct_keys(&ckeys, if col_sort.unsigned_abs() as usize <= cf.cols { col_sort } else { 0 });
-    if rk.len().saturating_add(2).saturating_mul((ck.len() + 1).saturating_mul(vals.cols).saturating_add(rf.cols)) > MAX_CELLS {
-        return Err(CellError::Num);
-    }
     let mut cell: HashMap<(String, String), Vec<usize>> = HashMap::new();
     for ((r, c), &i) in rkeys.iter().zip(ckeys.iter()).zip(p.rows.iter()) {
         cell.entry((row_key(r), row_key(c))).or_default().push(i);
@@ -832,6 +842,14 @@ fn pivotby(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
         cols.insert(0, None);
     }
     let lead = rf.cols;
+    let value_row = vals.cols > 1 || p.show_headers;
+    let header_rows = cf.cols.saturating_add(usize::from(value_row));
+    let body_rows = rk.len().saturating_add(usize::from(row_total != 0));
+    // Reject before building any header or body row: every column-field header row is as wide as the whole grid.
+    let (height, width) = pivot_dims(header_rows, body_rows, cols.len(), vals.cols, lead);
+    if height.saturating_mul(width) > MAX_CELLS {
+        return Err(CellError::Num);
+    }
     let mut out: Vec<Vec<Value>> = Vec::new();
     // Column header rows: one per column field, plus value names when several value columns.
     for level in 0..cf.cols {
@@ -847,7 +865,7 @@ fn pivotby(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
         }
         out.push(line);
     }
-    if vals.cols > 1 || p.show_headers {
+    if value_row {
         let mut line: Vec<Value> = if p.show_headers { p.field_headers.iter().take(lead).cloned().collect() } else { vec![Value::Empty; lead] };
         line.resize(lead, Value::Empty);
         for _ in &cols {
@@ -1132,6 +1150,17 @@ mod tests {
         is_err(ev("TOROW", vec![av(arr(vec![vec![Value::Empty]])), n(1.0)]), CellError::Calc);
     }
 
+    #[test]
+    fn output_size_checked_before_padding() {
+        assert_eq!(super::check_output_size(1_000_001, 10), Err(CellError::Num));
+        assert_eq!(super::check_output_size(usize::MAX, 2), Err(CellError::Num));
+        assert_eq!(super::check_output_size(1_000_000, 10), Ok(()));
+        // A 1M-row column beside a 9-wide row: ~1M input cells, but the padded result would be 10,000,010.
+        let tall = Value::from(gridcraft_core::Array::column(vec![nv(1.0); 1_000_001]));
+        let wide = row(&[1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0, 9.0]);
+        is_err(ev("HSTACK", vec![av(tall), av(wide)]), CellError::Num);
+    }
+
     #[test]
     fn wrapping() {
         let r = ev("WRAPROWS", vec![av(row(&[1.0, 2.0, 3.0, 4.0, 5.0])), n(2.0)]);
@@ -1225,4 +1254,29 @@ mod tests {
             ]
         );
     }
+
+    #[test]
+    fn pivotby_size_check_counts_column_header_rows() {
+        // One row, n column fields and n value columns: n header rows + value-name row + body row + total row,
+        // each 1 + 2n wide. The size checked up front matches the grid PIVOTBY builds.
+        let dims = |k: u32, totals: bool| {
+            let fields: Vec<f64> = (0..k).map(f64::from).collect();
+            let mut args = vec![av(row(&[1.0])), av(row(&fields)), av(row(&fields)), t("SUM")];
+            if !totals {
+                args.extend([empty(), n(0.0), empty(), n(0.0)]);
+            }
+            let r = rows_of(&ev("PIVOTBY", args));
+            (r.len(), r.first().map_or(0, Vec::len))
+        };
+        assert_eq!(dims(2, true), super::pivot_dims(3, 2, 2, 2, 1));
+        assert_eq!(dims(10, true), (13, 21));
+        assert_eq!(dims(10, true), super::pivot_dims(11, 2, 2, 10, 1));
+        assert_eq!(dims(10, false), (12, 11));
+        assert_eq!(dims(10, false), super::pivot_dims(11, 1, 1, 10, 1));
+        // n = 2300: the 2300 header rows alone are 10.58M cells, so the check must count them before any is built.
+        let (h, w) = super::pivot_dims(2301, 2, 2, 2300, 1);
+        assert!(2300 * w > crate::util::MAX_CELLS && h * w > crate::util::MAX_CELLS);
+        let wide: Vec<f64> = (0..2300).map(f64::from).collect();
+        is_err(ev("PIVOTBY", vec![av(row(&[1.0])), av(row(&wide)), av(row(&wide)), t("SUM")]), CellError::Num);
+    }
 }

crates/functions/src/financial.rs

@@ -321,7 +321,8 @@ fn mirr(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
             neg += x / (1.0 + fr).powi(i as i32);
         }
     }
-    if pos == 0.0 || neg == 0.0 {
+    // No positive flow is not an error in Excel: the formula below gives -1.
+    if neg == 0.0 {
         return Err(CellError::Div0);
     }
     let r = (-pos * (1.0 + rr).powf(n - 1.0) / neg).powf(1.0 / (n - 1.0)) - 1.0;
@@ -1813,6 +1814,8 @@ mod tests {
         close_tol(ev("MIRR", vec![rf(m), n(0.1), n(0.12)]), 0.1260943, 1e-6);
         close_tol(ev("MIRR", vec![rf(col(&[-120000.0, 39000.0, 30000.0, 21000.0])), n(0.1), n(0.12)]), -0.048044655, 1e-7);
         is_err(ev("MIRR", vec![rf(col(&[1.0, 2.0])), n(0.1), n(0.1)]), CellError::Div0);
+        // Excel 365 gives -1 when every flow is negative: the positive flows are worth nothing.
+        close_tol(ev("MIRR", vec![rf(col(&[-10000.0, -3400.0, -6500.0, -1000.0])), n(0.07), n(0.01)]), -1.0, 1e-12);
         close(ev("FVSCHEDULE", vec![n(1.0), av(row(&[0.09, 0.11, 0.1]))]), 1.33089);
         close(ev("EFFECT", vec![n(0.0525), n(4.0)]), 0.0535426673707584);
         is_err(ev("EFFECT", vec![n(-0.1), n(4.0)]), CellError::Num);

crates/functions/src/lib.rs

@@ -15,7 +15,7 @@
 use std::collections::HashMap;
 use std::sync::OnceLock;
 
-use gridcraft_core::{CellError, DateSystem, Value};
+use gridcraft_core::{Array, CellError, DateSystem, Value};
 
 /// Builds a [`FnSpec`] whose implementation returns `Result<Value, CellError>`.
 ///
@@ -105,6 +105,12 @@ pub trait Ctx {
     fn now_serial(&self) -> f64;
     /// Uniform in [0, 1).
     fn random(&mut self) -> f64;
+    /// For the database functions: whether the formula in the criteria cell at (`row`, `col`) holds
+    /// for `record` (a row of `db` below its labels). `None` when that cell holds no formula or the
+    /// criteria didn't come from a reference.
+    fn computed_criterion(&mut self, _row: usize, _col: usize, _db: &Array, _record: usize) -> Option<bool> {
+        None
+    }
 }
 
 pub type FnImpl = fn(&[Arg], &mut dyn Ctx) -> Value;
@@ -160,6 +166,11 @@ impl FnSpec {
             None => self.scalar_args.last().copied().unwrap_or(false),
         }
     }
+
+    /// Whether a call with `n` arguments is valid (Excel allows at most 255).
+    pub fn accepts(&self, n: usize) -> bool {
+        (self.min_args..=self.max_args).contains(&n) && n <= 255
+    }
 }
 
 /// Variadic marker for `max_args`.
@@ -192,7 +203,8 @@ fn registry() -> &'static (Vec<FnSpec>, HashMap<&'static str, usize>) {
     })
 }
 
-/// Looks a function up by name (case-insensitive; `_xlfn.`, `_xlws.` and `_xludf.`-free names).
+/// Looks a function up by name (case-insensitive; `_xlfn.`- and `_xlws.`-free names). A
+/// `_xludf.` name is user-defined and never found.
 pub fn lookup(name: &str) -> Option<&'static FnSpec> {
     let mut n = name.trim().to_ascii_uppercase();
     loop {
@@ -215,7 +227,7 @@ pub fn all() -> &'static [FnSpec] {
 
 /// Calls a function with array lifting applied. Wrong arity gives `#VALUE!`.
 pub fn call(spec: &FnSpec, args: &[Arg], ctx: &mut dyn Ctx) -> Value {
-    if args.len() < spec.min_args || args.len() > spec.max_args || args.len() > 255 {
+    if !spec.accepts(args.len()) {
         return Value::Error(CellError::Value);
     }
     lift::call_lifted(spec, args, ctx)

crates/functions/src/lookup.rs

@@ -33,43 +33,77 @@ fn find_exact(x: &Value, hay: &[Value], wild: bool, reverse: bool) -> Option<usi
     if reverse { hay.iter().rposition(|v| lookup_equal(x, v, wild)) } else { hay.iter().position(|v| lookup_equal(x, v, wild)) }
 }
 
-/// Binary search over the entries of the needle's type, assuming they are sorted ascending
-/// (`desc = false`) or descending. Returns the position of the last entry that is `<= x`
-/// (ascending) or `>= x` (descending), like Excel's approximate match.
+/// Approximate match of VLOOKUP, HLOOKUP, LOOKUP and MATCH: the position of the largest entry
+/// `<= x` in data sorted ascending (`desc = false`), or of the smallest entry `>= x` in data
+/// sorted descending. Like Excel this is a bisection over the whole vector, so on unsorted data
+/// it answers what Excel answers rather than a linear "best" entry:
+/// - the probe is the middle entry of the remaining window; a probe whose type differs from the
+///   needle (text vs number vs logical, blanks, errors) is replaced by the nearest entry of the
+///   needle's type below it in the window; when there is none the window moves up past it, so
+///   entries of other types are skipped (`LOOKUP(9.9E+307, range)` finds the last number);
+/// - a probe equal to the needle ends the search at once (the run of equal entries that follows
+///   it is taken, so sorted duplicates give the last one).
+///
+/// Observed in Excel: `VLOOKUP(534, {"INTEGRAL";0;1;2;534;9999999999;-9999999999}, …)` finds 534,
+/// `HLOOKUP("STRING", {"INTEGRAL","DOUBLE","BLANK","STRING","REF","AREA (rows)",<blank>}, …)`
+/// finds "STRING" and `LOOKUP("DOUBLE", {"DOUBLE","BLANK","STRING","REF","AREA (rows)"}, …)`
+/// finds "DOUBLE". Work is linear in the vector length at worst.
 fn bsearch_last(x: &Value, hay: &[Value], desc: bool) -> Option<usize> {
-    let idx: Vec<usize> = hay.iter().enumerate().filter(|(_, v)| same_type(x, v)).map(|(i, _)| i).collect();
-    let (mut lo, mut hi) = (0usize, idx.len());
-    // Find the first filtered position where the "passes" predicate fails.
-    while lo < hi {
+    let mut hi = hay.len().checked_sub(1)?;
+    let mut lo = 0usize;
+    let mut best = None;
+    while lo <= hi {
         let mid = lo + (hi - lo) / 2;
-        let v = idx.get(mid).and_then(|&i| hay.get(i))?;
-        let o = compare(v, x);
-        let ok = if desc { o != Ordering::Less } else { o != Ordering::Greater };
-        if ok {
+        let Some(j) = (lo..=mid).rev().find(|&j| hay.get(j).is_some_and(|v| same_type(x, v))) else {
             lo = mid + 1;
-        } else {
-            hi = mid;
-        }
-    }
-    if lo == 0 { None } else { idx.get(lo - 1).copied() }
-}
-
-/// Binary search returning the first entry `>= x` (ascending) or `<= x` (descending).
-fn bsearch_first(x: &Value, hay: &[Value], desc: bool) -> Option<usize> {
-    let idx: Vec<usize> = hay.iter().enumerate().filter(|(_, v)| same_type(x, v)).map(|(i, _)| i).collect();
-    let (mut lo, mut hi) = (0usize, idx.len());
-    while lo < hi {
-        let mid = lo + (hi - lo) / 2;
-        let v = idx.get(mid).and_then(|&i| hay.get(i))?;
+            continue;
+        };
+        let v = hay.get(j)?;
         let o = compare(v, x);
+        if o == Ordering::Equal {
+            let mut k = j;
+            while hay.get(k + 1).is_some_and(|w| same_type(x, w) && compare(w, x) == Ordering::Equal) {
+                k += 1;
+            }
+            return Some(k);
+        }
         let before = if desc { o == Ordering::Greater } else { o == Ordering::Less };
         if before {
+            best = Some(j);
             lo = mid + 1;
+        } else if j == 0 {
+            break;
         } else {
-            hi = mid;
+            hi = j - 1;
         }
     }
-    idx.get(lo).copied()
+    best
+}
+
+/// Order of an entry relative to the needle for XLOOKUP / XMATCH binary search (search mode ±2):
+/// Excel's sort order over all types (numbers < text < logicals < errors), reversed for
+/// descending data, with blanks always last like a sort leaves them. Unlike the legacy
+/// approximate match no entry is skipped (observed: `XLOOKUP(46523, {9700;"xyz";"xyz";160726;
+/// 204100;510300}, …, 0, 1, 2)` returns the row of the first "xyz").
+fn binary_order(v: &Value, x: &Value, desc: bool) -> Ordering {
+    match v {
+        Value::Empty => Ordering::Greater,
+        _ if desc => compare(v, x).reverse(),
+        _ => compare(v, x),
+    }
+}
+
+/// Binary search for the first entry not ordered before the needle (`>= x` ascending, `<= x`
+/// descending).
+fn bsearch_first(x: &Value, hay: &[Value], desc: bool) -> Option<usize> {
+    let p = hay.partition_point(|v| binary_order(v, x, desc) == Ordering::Less);
+    (p < hay.len()).then_some(p)
+}
+
+/// Binary search for the last entry not ordered after the needle (`<= x` ascending, `>= x`
+/// descending).
+fn bsearch_upto(x: &Value, hay: &[Value], desc: bool) -> Option<usize> {
+    hay.partition_point(|v| binary_order(v, x, desc) != Ordering::Greater).checked_sub(1)
 }
 
 /// A 1-D view of an array (row or column), `None` when it is 2-D.
@@ -199,12 +233,13 @@ fn xsearch(x: &Value, hay: &[Value], match_mode: i64, search_mode: i64) -> R<Opt
                 if desc {
                     bsearch_first(x, hay, true)
                 } else {
-                    bsearch_last(x, hay, false)
+                    bsearch_upto(x, hay, false)
                 }
             }
+            // Next larger: first >= x (ascending) / last >= x (descending).
             _ => {
                 if desc {
-                    bsearch_last(x, hay, true)
+                    bsearch_upto(x, hay, true)
                 } else {
                     bsearch_first(x, hay, false)
                 }
@@ -248,7 +283,7 @@ fn xsearch(x: &Value, hay: &[Value], match_mode: i64, search_mode: i64) -> R<Opt
 fn bsearch_exact(x: &Value, hay: &[Value], desc: bool) -> Option<usize> {
     let p = bsearch_first(x, hay, desc)?;
     let v = hay.get(p)?;
-    if compare(v, x) == Ordering::Equal { Some(p) } else { None }
+    if binary_order(v, x, desc) == Ordering::Equal { Some(p) } else { None }
 }
 
 fn xlookup(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
@@ -378,9 +413,16 @@ fn transpose(args: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     }
 }
 
+/// Sheet text for ADDRESS, quoted when it needs to be. A `[Book]Sheet` prefix is judged by its
+/// parts (Microsoft's ADDRESS examples: `"[Book1]Sheet1"` stays bare, `"EXCEL SHEET"` becomes
+/// `'EXCEL SHEET'`).
 fn quote_sheet(s: &str) -> String {
-    let plain =
-        !s.is_empty() && s.chars().all(|c| c.is_alphanumeric() || c == '_' || c == '.') && !s.chars().next().is_some_and(|c| c.is_ascii_digit());
+    let word = |p: &str| p.chars().all(|c| c.is_alphanumeric() || c == '_' || c == '.');
+    let bare_sheet = |p: &str| !p.is_empty() && word(p) && !p.chars().next().is_some_and(|c| c.is_ascii_digit());
+    let plain = match s.strip_prefix('[').and_then(|r| r.split_once(']')) {
+        Some((book, sheet)) => !book.is_empty() && word(book) && bare_sheet(sheet),
+        None => bare_sheet(s),
+    };
     if plain { s.to_string() } else { format!("'{}'", s.replace('\'', "''")) }
 }
 
@@ -574,6 +616,45 @@ mod tests {
         close(ev("LOOKUP", vec![t("zz"), av(mixed), av(row(&[1.0, 2.0, 3.0, 4.0]))]), 4.0);
     }
 
+    /// Approximate matches over unsorted, mixed-type data as observed in Excel
+    /// (FormulaEvalTestData rows "Vlookup", "Hlookup", "Lookup"): Excel bisects the whole
+    /// vector and stops at an equal entry, so answers differ from a "best entry" scan.
+    #[test]
+    fn approximate_match_follows_bisection() {
+        // B6:H12 of the test data: header row, then one row per data kind.
+        let data = arr(vec![
+            vec![tv("INTEGRAL"), tv("DOUBLE"), tv("BLANK"), tv("STRING"), tv("REF"), tv("AREA (rows)"), Value::Empty],
+            vec![nv(0.0), nv(0.0), Value::Empty, tv(""), nv(0.0), nv(1.0), nv(2.0)],
+            vec![nv(1.0), nv(0.00001), Value::Empty, tv("nospaces"), nv(1.0), nv(1.001), nv(2.999)],
+            vec![nv(2.0), nv(1.1), Value::Empty, tv("sp ace s"), nv(9999999999.0), nv(2.3456), nv(3.4567)],
+            vec![nv(534.0), nv(1.00001), Value::Empty, tv("endsWithSpace "), nv(0.00001), tv("alphanum"), nv(3.0)],
+            vec![nv(9999999999.0), nv(2.99999), Value::Empty, tv(" beginsWithSpace"), nv(0.0), tv("blanksIncl"), Value::Empty],
+            vec![nv(-9999999999.0), nv(999999.99999), Value::Empty, tv("non-numeric"), tv("sp ace s"), tv("E8"), nv(545.0)],
+        ]);
+        close(ev("VLOOKUP", vec![n(534.0), rf(data.clone()), n(2.0)]), 1.00001);
+        is_text(ev("VLOOKUP", vec![n(534.0), rf(data.clone()), n(4.0)]), "endsWithSpace ");
+        is_text(ev("VLOOKUP", vec![n(534.0), rf(data.clone()), n(4.0), b(true)]), "endsWithSpace ");
+        is_text(ev("HLOOKUP", vec![t("STRING"), rf(data.clone()), n(6.0), b(true)]), " beginsWithSpace");
+        let keys = arr(vec![vec![tv("DOUBLE"), tv("BLANK"), tv("STRING"), tv("REF"), tv("AREA (rows)")]]);
+        let results = arr(vec![vec![nv(1.1), Value::Empty, tv("sp ace s"), nv(9999999999.0), nv(2.3456)]]);
+        close(ev("LOOKUP", vec![t("DOUBLE"), rf(keys), rf(results)]), 1.1);
+        let b6_b15 = col(&[0.0, 1.0, 2.0, 534.0, 9999999999.0, -9999999999.0, -534.0, -2.0, -1.0]);
+        let mut keys = vec![tv("INTEGRAL")];
+        keys.extend(rows_of(&b6_b15).into_iter().flatten());
+        let words = ["STRING", "", "nospaces", "sp ace s", "endsWithSpace ", " beginsWithSpace", "non-numeric", "0", "0.000001", "1"];
+        let e_col = arr(words.iter().map(|w| vec![tv(w)]).collect());
+        is_text(ev("LOOKUP", vec![n(534.0), rf(arr(keys.into_iter().map(|k| vec![k]).collect())), rf(e_col)]), "endsWithSpace ");
+        // Sorted duplicates give the last one; descending data with MATCH -1 too.
+        close(ev("MATCH", vec![n(2.0), av(row(&[1.0, 2.0, 2.0, 2.0, 3.0])), n(1.0)]), 4.0);
+        close(ev("MATCH", vec![n(20.0), av(row(&[40.0, 20.0, 20.0, 10.0])), n(-1.0)]), 3.0);
+        // Only text and blanks: no number to find.
+        is_err(ev("MATCH", vec![n(5.0), av(arr(vec![vec![tv("a"), Value::Empty, tv("b")]]))]), CellError::NA);
+        // A long run of trailing blanks (whole-column lookups) still finds the last number.
+        let mut tall = vec![vec![nv(1.0)], vec![nv(2.0)], vec![nv(3.0)]];
+        tall.extend((0..10_000).map(|_| vec![Value::Empty]));
+        close(ev("MATCH", vec![n(9.0), rf(arr(tall))]), 3.0);
+    }
+
     #[test]
     fn match_fn() {
         let v = col(&[10.0, 20.0, 30.0, 40.0]);
@@ -632,6 +713,23 @@ mod tests {
         is_err(ev("XLOOKUP", vec![n(2.0), rf(table()), rf(vals)]), CellError::Value);
     }
 
+    /// XLOOKUP binary search (search mode ±2). Observed in Excel (xlookup.xlsx, Sheet2): next
+    /// larger over ascending data with text mixed in (0.22) and over descending data (0.24); the
+    /// bisection compares across types in sort order (numbers < text) instead of skipping text.
+    /// The other modes follow from the same order.
+    #[test]
+    fn xlookup_binary_search_observed() {
+        let rates = col(&[0.1, 0.22, 0.24, 0.32, 0.35, 0.37]);
+        let incomes = arr(vec![vec![nv(9700.0)], vec![tv("xyz")], vec![tv("xyz")], vec![nv(160726.0)], vec![nv(204100.0)], vec![nv(510300.0)]]);
+        close(ev("XLOOKUP", vec![n(46523.0), rf(incomes.clone()), rf(rates.clone()), n(0.0), n(1.0), n(2.0)]), 0.22);
+        close(ev("XLOOKUP", vec![n(46523.0), rf(incomes), rf(rates), n(0.0), n(-1.0), n(2.0)]), 0.1);
+        let desc_incomes = col(&[510300.0, 204100.0, 160726.0, 84200.0, 39475.0, 9700.0]);
+        let desc_rates = col(&[0.37, 0.35, 0.32, 0.24, 0.22, 0.1]);
+        close(ev("XLOOKUP", vec![n(46523.0), rf(desc_incomes.clone()), rf(desc_rates.clone()), n(0.0), n(1.0), n(-2.0)]), 0.24);
+        close(ev("XLOOKUP", vec![n(46523.0), rf(desc_incomes.clone()), rf(desc_rates.clone()), n(0.0), n(-1.0), n(-2.0)]), 0.22);
+        close(ev("XLOOKUP", vec![n(84200.0), rf(desc_incomes), rf(desc_rates), n(0.0), n(0.0), n(-2.0)]), 0.24);
+    }
+
     fn table_rows3() -> Value {
         arr(vec![vec![nv(1.0), tv("one"), nv(10.0)], vec![nv(2.0), tv("two"), nv(20.0)], vec![nv(3.0), tv("three"), nv(30.0)]])
     }
@@ -682,6 +780,17 @@ mod tests {
         is_text(ev("ADDRESS", vec![n(2.0), n(3.0), n(4.0), b(false)]), "R[2]C[3]");
         is_text(ev("ADDRESS", vec![n(1.0), n(1.0), n(1.0), b(true), t("Sheet1")]), "Sheet1!$A$1");
         is_text(ev("ADDRESS", vec![n(1.0), n(1.0), n(1.0), b(true), t("My Sheet")]), "'My Sheet'!$A$1");
+        // Observed in Excel (FormulaEvalTestData) and Microsoft's ADDRESS examples; the last
+        // case follows from the quoting rule for sheet names.
+        let cases: [(f64, f64, f64, bool, &str, &str); 4] = [
+            (2.0, 3.0, 3.0, true, "[Book1]Sheet1", "[Book1]Sheet1!$C2"),
+            (2.0, 3.0, 1.0, false, "[Book1]Sheet1", "[Book1]Sheet1!R2C3"),
+            (2.0, 3.0, 1.0, false, "EXCEL SHEET", "'EXCEL SHEET'!R2C3"),
+            (1.0, 1.0, 1.0, true, "[My Book]Sheet1", "'[My Book]Sheet1'!$A$1"),
+        ];
+        for (r, c, abs, a1, sheet, want) in cases {
+            is_text(ev("ADDRESS", vec![n(r), n(c), n(abs), b(a1), t(sheet)]), want);
+        }
         is_text(ev("ADDRESS", vec![n(1048576.0), n(16384.0)]), "$XFD$1048576");
         is_err(ev("ADDRESS", vec![n(0.0), n(1.0)]), CellError::Value);
         is_err(ev("ADDRESS", vec![n(1.0), n(16385.0)]), CellError::Value);

crates/functions/src/math.rs

@@ -75,7 +75,15 @@ fn round_dir(x: f64, digits: i32, up: bool) -> f64 {
     }
     let s = clean(scaled);
     let r = if up { s.ceil() } else { s.floor() };
-    let out = if neg { r * f } else { clean(r / f) };
+    // Toward zero, r == 0 with an infinite scale would be 0 * inf = NaN (#NUM!); the result is simply
+    // zero. Away from zero the true result (10^309 or more) is not a number, so ROUNDUP stays #NUM!.
+    let out = if !neg {
+        clean(r / f)
+    } else if r == 0.0 && !up {
+        0.0
+    } else {
+        r * f
+    };
     if x < 0.0 { -out } else { out }
 }
 
@@ -109,20 +117,24 @@ fn product(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     num_val(v.iter().product())
 }
 
+/// SUMPRODUCT: non-numeric entries of arrays and multi-cell ranges count as 0, but a scalar
+/// argument holding text (a literal or a single-cell reference) is `#VALUE!` (observed:
+/// `SUMPRODUCT(G1330:G1330,I1330:I1330)` with G1330 = the text "4" is `#VALUE!`).
 fn sumproduct(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
-    let arrays: Vec<_> = a.iter().map(|x| as_array(&x.value)).collect();
-    let Some(first) = arrays.first() else { return Err(CellError::Value) };
+    let arrays: Vec<_> = a.iter().map(|x| (as_array(&x.value), !matches!(x.value, Value::Array(_)))).collect();
+    let Some((first, _)) = arrays.first() else { return Err(CellError::Value) };
     let (rows, cols) = (first.rows, first.cols);
-    if arrays.iter().any(|x| x.rows != rows || x.cols != cols) {
+    if arrays.iter().any(|(x, _)| x.rows != rows || x.cols != cols) {
         return Err(CellError::Value);
     }
     let mut total = 0.0;
     for i in 0..rows.saturating_mul(cols) {
         let mut p = 1.0;
-        for arr in &arrays {
+        for (arr, scalar) in &arrays {
             match arr.data.get(i) {
                 Some(Value::Number(n)) => p *= n,
                 Some(Value::Error(e)) => return Err(*e),
+                Some(Value::Text(_)) if *scalar => return Err(CellError::Value),
                 _ => p = 0.0,
             }
         }
@@ -630,16 +642,18 @@ fn radians(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 
 const NUMERALS: [(char, u32); 7] = [('I', 1), ('V', 5), ('X', 10), ('L', 50), ('C', 100), ('D', 500), ('M', 1000)];
 
-/// Tokens (text, value) for a ROMAN form, largest value first. Form 0 is classic; higher forms
-/// allow subtracting progressively smaller numerals (max ratio 10, 20, 50, 100, 1000).
+/// Tokens (text, value) for a ROMAN form, largest value first. Form 0 is classic; each higher
+/// form widens one of two limits on the subtracted numeral's ratio to the larger one, alternating:
+/// the limit for I/X/C (10, 10, 100, 100, 1000) and for V/L (none, 20, 20, 200, 200). So form 2
+/// allows IC and XM but not VD, and form 3 adds VD and VM but not ID.
 fn roman_tokens(form: u32) -> Vec<(String, u32)> {
-    let max_ratio = [10, 20, 50, 100, 1000].get(form as usize).copied().unwrap_or(10);
+    let (pow10_max, five_max) = [(10, 0), (10, 20), (100, 20), (100, 200), (1000, 200)].get(form as usize).copied().unwrap_or((10, 0));
     let mut toks: Vec<(String, u32)> = NUMERALS.iter().map(|(c, v)| (c.to_string(), *v)).collect();
     for (i, (sc, sv)) in NUMERALS.iter().enumerate() {
         for (lc, lv) in NUMERALS.iter().skip(i + 1) {
             let ratio = lv / sv;
             let pow10 = matches!(sc, 'I' | 'X' | 'C');
-            let ok = if form == 0 { pow10 && ratio <= 10 } else { ratio <= max_ratio };
+            let ok = ratio <= if pow10 { pow10_max } else { five_max };
             let value = lv - sv;
             // Skip pairs that equal a single numeral (VX = V) – they are never shorter.
             if ok && !NUMERALS.iter().any(|(_, v)| *v == value) {
@@ -946,6 +960,9 @@ fn criteria_mask(a: &[Arg], first_pair: usize, rows: usize, cols: usize) -> R<Ve
     if rest.is_empty() || rest.len() % 2 != 0 {
         return Err(CellError::Value);
     }
+    // A text criterion over 255 characters is `#VALUE!` only when there is a single criteria
+    // pair. With two or more pairs Excel matches its first 255 characters instead.
+    let single_pair = rest.len() == 2;
     let mut mask = vec![true; rows.saturating_mul(cols)];
     for pair in rest.chunks(2) {
         let (Some(range), Some(crit)) = (pair.first(), pair.get(1)) else { return Err(CellError::Value) };
@@ -953,7 +970,8 @@ fn criteria_mask(a: &[Arg], first_pair: usize, rows: usize, cols: usize) -> R<Ve
         if r.rows != rows || r.cols != cols {
             return Err(CellError::Value);
         }
-        let c = Criterion::parse(&crit.value.scalar());
+        let scalar = crit.value.scalar();
+        let c = if single_pair { Criterion::parse_arg(&scalar)? } else { Criterion::parse_arg_truncated(&scalar) };
         for (m, v) in mask.iter_mut().zip(r.iter()) {
             if *m && !c.matches(v) {
                 *m = false;
@@ -1013,7 +1031,7 @@ fn minifs(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 
 fn countif(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     let range = as_array(&crate::util::arg(a, 0)?.value);
-    let c = Criterion::parse(&crate::util::arg(a, 1)?.value.scalar());
+    let c = Criterion::parse_arg(&crate::util::arg(a, 1)?.value.scalar())?;
     num_val(range.iter().filter(|v| c.matches(v)).count() as f64)
 }
 
@@ -1022,7 +1040,7 @@ fn countif(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
 /// the evaluator does that resizing (it has the references), so cells line up one to one here.
 fn if_numbers(a: &[Arg]) -> R<Vec<f64>> {
     let range = as_array(&crate::util::arg(a, 0)?.value);
-    let c = Criterion::parse(&crate::util::arg(a, 1)?.value.scalar());
+    let c = Criterion::parse_arg(&crate::util::arg(a, 1)?.value.scalar())?;
     let sum_range = if has(a, 2) { Some(as_array(&crate::util::arg(a, 2)?.value)) } else { None };
     let mut out = Vec::new();
     for r in 0..range.rows {
@@ -1336,6 +1354,27 @@ mod tests {
         is_err(ev("SUMXMY2", vec![av(x), av(row(&[1.0]))]), NA);
     }
 
+    /// SUMPRODUCT cases observed in Excel (FormulaEvalTestData, row "Sumproduct"): scalars and
+    /// single-cell references multiply in, text in a scalar argument is `#VALUE!`, sizes must match.
+    #[test]
+    fn sumproduct_scalar_arguments() {
+        let cases: Vec<(Vec<crate::Arg>, Result<f64, CellError>)> = vec![
+            (vec![n(3.0), rf(nv(534.0)), rf(nv(1.1))], Ok(1762.2)),
+            (vec![rf(nv(1.1)), n(3.0), rf(nv(534.0)), rf(nv(1.1))], Ok(1938.42)),
+            (vec![n(2.0), rf(col(&[1.00001, 2.99999]))], Err(CellError::Value)),
+            (vec![rf(tv("4")), rf(nv(2.0))], Err(CellError::Value)),
+            (vec![t("4"), n(2.0)], Err(CellError::Value)),
+            (vec![rf(nv(3.0)), rf(Value::Error(CellError::Ref))], Err(CellError::Ref)),
+            (vec![av(arr(vec![vec![tv("4")]])), n(2.0)], Ok(0.0)),
+        ];
+        for (args, want) in cases {
+            match want {
+                Ok(x) => close(ev("SUMPRODUCT", args), x),
+                Err(err) => is_err(ev("SUMPRODUCT", args), err),
+            }
+        }
+    }
+
     #[test]
     fn rounding() {
         close(ev2("ROUND", 2.675, 2.0), 2.68);
@@ -1348,6 +1387,13 @@ mod tests {
         close(ev2("ROUNDDOWN", -3.9, 0.0), -3.0);
         close(ev2("ROUNDDOWN", 2.71989, 3.0), 2.719);
         close(ev2("ROUNDDOWN", 31415.92654, -2.0), 31400.0);
+        for digits in [-308.0, -309.0, -400.0] {
+            for x in [1234.0, -1234.0, 0.5] {
+                close(ev2("ROUNDDOWN", x, digits), 0.0);
+                close(ev2("TRUNC", x, digits), 0.0);
+            }
+        }
+        assert!(matches!(ev2("ROUNDUP", 1234.0, -309.0), Value::Error(CellError::Num)));
         close(ev2("ROUNDUP", 0.1 + 0.2, 1.0), 0.3);
         close(ev2("TRUNC", 8.987, 2.0), 8.98);
         close(ev1("TRUNC", -8.9), -8.0);
@@ -1528,6 +1574,43 @@ mod tests {
         is_err(ev("DECIMAL", vec![t("12"), n(2.0)]), Num);
     }
 
+    /// Every number where Excel's forms 2 and 3 differ from a plain ratio limit (issue #733):
+    /// form 2 subtracts I from C and X from M, form 3 also V from M.
+    #[test]
+    fn roman_forms_two_and_three_match_excel() {
+        const HUNDREDS: [&str; 10] = ["", "C", "CC", "CCC", "CD", "D", "DC", "DCC", "DCCC", "CM"];
+        const ONES: [&str; 10] = ["", "I", "II", "III", "IV", "V", "VI", "VII", "VIII", "IX"];
+        let mut cases = Vec::new();
+        for thousands in 0..4usize {
+            let m = "M".repeat(thousands);
+            for (h, hundreds) in HUNDREDS.iter().enumerate() {
+                if h != 4 && h != 9 {
+                    cases.push((thousands * 1000 + h * 100 + 99, 2.0, format!("{m}{hundreds}IC")));
+                }
+            }
+            for (o, ones) in ONES.iter().enumerate() {
+                cases.push((thousands * 1000 + 990 + o, 2.0, format!("{m}XM{ones}")));
+            }
+            for (o, ones) in ONES.iter().enumerate().take(5) {
+                cases.push((thousands * 1000 + 995 + o, 3.0, format!("{m}VM{ones}")));
+            }
+        }
+        assert_eq!(cases.len(), 92);
+        for (number, form, want) in &cases {
+            is_text(ev2("ROMAN", *number as f64, *form), want);
+        }
+        // Neighbours that already matched: form 2 still has no VD or ID, form 3 no ID.
+        is_text(ev2("ROMAN", 495.0, 2.0), "XDV");
+        is_text(ev2("ROMAN", 495.0, 3.0), "VD");
+        is_text(ev2("ROMAN", 1499.0, 2.0), "MXDIX");
+        is_text(ev2("ROMAN", 999.0, 0.0), "CMXCIX");
+        is_text(ev2("ROMAN", 999.0, 1.0), "LMVLIV");
+        is_text(ev2("ROMAN", 999.0, 4.0), "IM");
+        is_text(ev2("ROMAN", 995.0, 4.0), "VM");
+        is_text(ev2("ROMAN", 99.0, 1.0), "VCIV");
+        is_text(ev2("ROMAN", 99.0, 4.0), "IC");
+    }
+
     #[test]
     fn matrices() {
         let a = arr(vec![vec![nv(1.0), nv(2.0)], vec![nv(3.0), nv(4.0)]]);
@@ -1618,4 +1701,77 @@ mod tests {
         is_err(ev("COUNTIFS", vec![rf(qty.clone()), t(">1"), rf(qty)]), CellError::Value);
         is_err(ev("SUMIF", vec![rf(col(&[1.0, 2.0])), t(">0"), rf(arr(vec![vec![Value::Error(NA)], vec![nv(1.0)]]))]), NA);
     }
+
+    #[test]
+    fn criteria_over_255_chars_are_value_errors_with_one_pair_and_truncated_with_more() {
+        let ok = "x".repeat(255);
+        let long = "x".repeat(256);
+        let cells = arr(vec![vec![tv(&ok)], vec![tv(&long)]]);
+        let qty = col(&[1.0, 2.0]);
+        close(ev("COUNTIF", vec![rf(cells.clone()), t(&ok)]), 1.0);
+        is_err(ev("COUNTIF", vec![rf(cells.clone()), t(&long)]), CellError::Value);
+        close(ev("SUMIFS", vec![rf(qty.clone()), rf(cells.clone()), t(&ok)]), 1.0);
+        is_err(ev("SUMIFS", vec![rf(qty.clone()), rf(cells.clone()), t(&long)]), CellError::Value);
+        is_err(ev("COUNTIFS", vec![rf(cells.clone()), t(&long)]), CellError::Value);
+        // With two or more pairs Excel matches the first 255 characters: the 255-character cell
+        // (quantity 1), not the 256-character one (quantity 2). Checked on Excel 2016 and 365.
+        let over = format!("{ok}y");
+        close(ev("COUNTIFS", vec![rf(cells.clone()), t(&long), rf(qty.clone()), t(">0")]), 1.0);
+        close(ev("SUMIFS", vec![rf(qty.clone()), rf(cells.clone()), t(&long), rf(qty.clone()), t(">0")]), 1.0);
+        close(ev("SUMIFS", vec![rf(qty.clone()), rf(qty.clone()), t(">0"), rf(cells.clone()), t(&over)]), 1.0);
+        close(ev("AVERAGEIFS", vec![rf(qty.clone()), rf(cells.clone()), t(&long), rf(qty.clone()), t(">0")]), 1.0);
+        close(ev("MAXIFS", vec![rf(qty.clone()), rf(cells.clone()), t(&"x".repeat(300)), rf(qty), t(">0")]), 1.0);
+    }
+
+    #[test]
+    fn criteria_over_255_utf16_units_follow_excel() {
+        // The tester's sheet, identical on Excel 2016 and Microsoft 365: A1:A6 hold these
+        // strings, B is the row number, and each row uses its own string as the criterion.
+        let e = "😀";
+        let strings =
+            [e.repeat(127), e.repeat(128), format!("{}{e}", "a".repeat(254)), format!("{}{e}", "a".repeat(253)), e.repeat(200), "я".repeat(256)];
+        let cells = arr(strings.iter().map(|s| vec![tv(s)]).collect());
+        let rows = col(&[1.0, 2.0, 3.0, 4.0, 5.0, 6.0]);
+        // COUNTIF, SUMIF, COUNTIFS with one pair, SUMIFS with a second pair `B,">0"`.
+        let expected: [Option<[f64; 4]>; 6] = [Some([1.0, 1.0, 1.0, 1.0]), None, None, Some([1.0, 4.0, 1.0, 4.0]), None, None];
+        for (s, want) in strings.iter().zip(expected) {
+            let countif = ev("COUNTIF", vec![rf(cells.clone()), t(s)]);
+            let sumif = ev("SUMIF", vec![rf(cells.clone()), t(s), rf(rows.clone())]);
+            let countifs = ev("COUNTIFS", vec![rf(cells.clone()), t(s)]);
+            let sumifs = ev("SUMIFS", vec![rf(rows.clone()), rf(cells.clone()), t(s), rf(rows.clone()), t(">0")]);
+            match want {
+                Some([a, b, c, d]) => {
+                    close(countif, a);
+                    close(sumif, b);
+                    close(countifs, c);
+                    close(sumifs, d);
+                }
+                // Over 255 units: `#VALUE!` with one pair; cut to 255 units with two, which
+                // matches no cell (for emoji it splits a surrogate pair).
+                None => {
+                    is_err(countif, CellError::Value);
+                    is_err(sumif, CellError::Value);
+                    is_err(countifs, CellError::Value);
+                    close(sumifs, 0.0);
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn criteria_cut_inside_a_surrogate_pair() {
+        let e = "😀";
+        let cells = arr(vec![vec![tv(&e.repeat(127))], vec![tv(&e.repeat(128))], vec![tv("zzz")], vec![Value::Empty]]);
+        let rows = col(&[1.0, 2.0, 3.0, 4.0]);
+        let sumifs = |crit: String| ev("SUMIFS", vec![rf(rows.clone()), rf(cells.clone()), t(&crit), rf(rows.clone()), t(">0")]);
+        // "=" + 😀×128 is 257 units: the cut after 255 keeps "=" and 127 whole emoji.
+        close(sumifs(format!("={}", e.repeat(128))), 1.0);
+        // With a two-unit prefix the cut keeps 126 emoji and half of the 127th. Such a criterion
+        // equals no cell text: "=" matches nothing and "<>" everything, blanks included.
+        close(sumifs(format!("=a{}", e.repeat(128))), 0.0);
+        close(sumifs(format!("<>{}", e.repeat(128))), 10.0);
+        // Comparisons treat it as sorting just above the 126 kept emoji.
+        close(sumifs(format!(">={}", e.repeat(128))), 1.0 + 2.0);
+        close(sumifs(format!("<={}", e.repeat(128))), 3.0);
+    }
 }

crates/functions/src/stat.rs

@@ -78,6 +78,35 @@ fn mode_sngl(v: &[f64]) -> R<f64> {
     modes(v).first().copied().ok_or(CellError::NA)
 }
 
+/// Numbers for MODE / MODE.SNGL / MODE.MULT. Inside multi-cell ranges and arrays only numbers
+/// count, like [`numbers`]. Scalar arguments differ from SUM: in Excel 365, text and logical
+/// values are skipped whether typed or referenced (even numeric text such as `"1"`, so
+/// `MODE(1,"1",2,3)` is `#N/A`, and `MODE(1,TRUE,TRUE,2)` is `#N/A`), but a single-cell reference
+/// to a blank cell is `#VALUE!` (`MODE(B9,2,D7)` with D7 blank). Arguments are processed left to
+/// right, so the first error wins. The results cached in POI's FormulaEvalTestData come from an
+/// older Excel that answered `#VALUE!` for typed text; they are not the reference here.
+fn mode_numbers(args: &[Arg]) -> R<Vec<f64>> {
+    let mut out = Vec::new();
+    for a in args {
+        match &a.value {
+            Value::Array(arr) => {
+                for v in arr.iter() {
+                    match v {
+                        Value::Number(n) => out.push(*n),
+                        Value::Error(e) => return Err(*e),
+                        _ => {}
+                    }
+                }
+            }
+            Value::Number(n) => out.push(*n),
+            Value::Error(e) => return Err(*e),
+            Value::Text(_) | Value::Bool(_) => {}
+            Value::Empty => return Err(CellError::Value),
+        }
+    }
+    Ok(out)
+}
+
 fn product(v: &[f64]) -> f64 {
     if v.is_empty() { 0.0 } else { v.iter().product() }
 }
@@ -277,7 +306,7 @@ fn countblank(a: &[Arg], _: C) -> R<Value> {
 }
 
 fn mode_mult(a: &[Arg], _: C) -> R<Value> {
-    let v = numbers(a)?;
+    let v = mode_numbers(a)?;
     let m = modes(&v);
     if m.is_empty() {
         return Err(CellError::NA);
@@ -433,7 +462,7 @@ fn prob(a: &[Arg], _: C) -> R<Value> {
     let (xs, ps) = arg_pairs(a, 0, 1)?;
     let lo = num(a, 2)?;
     let hi = if has(a, 3) { num(a, 3)? } else { lo };
-    if ps.iter().any(|&p| !(0.0..=1.0).contains(&p)) {
+    if ps.iter().any(|&p| p <= 0.0 || p > 1.0) {
         return Err(CellError::Num);
     }
     let total: f64 = ps.iter().sum();
@@ -1566,10 +1595,10 @@ pub(crate) fn specs() -> Vec<FnSpec> {
             numbers(a)?
         )?)),
         f!("MODE", 1, VAR, Compatibility, A, "MODE(number1, [number2], ...)", "Most frequently occurring number.", |a: &[Arg], _c: C| num_val(
-            mode_sngl(&numbers(a)?)?
+            mode_sngl(&mode_numbers(a)?)?
         )),
         f!("MODE.SNGL", 1, VAR, Statistical, A, "MODE.SNGL(number1, [number2], ...)", "Most frequently occurring number.", |a: &[Arg], _c: C| {
-            num_val(mode_sngl(&numbers(a)?)?)
+            num_val(mode_sngl(&mode_numbers(a)?)?)
         }),
         f!("MODE.MULT", 1, VAR, Statistical, A, "MODE.MULT(number1, [number2], ...)", "Vertical array of all the most frequent numbers.", mode_mult),
         f!("STDEV", 1, VAR, Compatibility, A, "STDEV(number1, [number2], ...)", "Sample standard deviation.", |a: &[Arg], _c: C| num_val(
@@ -2251,6 +2280,61 @@ mod tests {
         assert_eq!(rows_of(&ev("MODE.MULT", vec![c(&[1.0, 2.0, 3.0, 4.0, 3.0, 2.0, 1.0, 2.0, 3.0])])), vec![vec![nv(2.0)], vec![nv(3.0)]]);
     }
 
+    /// MODE argument semantics in Excel 365, on the inputs of FormulaEvalTestData (row "Mode"):
+    /// text is skipped, typed or referenced, but a single-cell reference to a blank cell is
+    /// `#VALUE!`; the first error from the left wins. The values cached in POI's file come from an
+    /// older Excel and say `#VALUE!` for `MODE(C9,E16,"1",B8)`, `MODE(B8,"1",2,3)` and
+    /// `MODE("1",1,#DIV/0!,2,3)`; Excel 365 gives `#N/A`, `#N/A` and `#DIV/0!`.
+    #[test]
+    fn mode_scalar_arguments() {
+        let data = arr(vec![vec![tv(""), nv(0.0), nv(1.0)], vec![tv("x"), nv(1.0), nv(1.001)], vec![tv("y"), nv(9e9), nv(2.3456)]]);
+        let cases: Vec<(Vec<crate::Arg>, Result<f64, CellError>)> = vec![
+            (vec![n(1.0), n(1.0), n(2.0), n(3.0)], Ok(1.0)),
+            (vec![rf(data)], Ok(1.0)),
+            (vec![rf(arr(vec![vec![nv(-1.1), Value::Empty, tv("1.1")]])), n(-1.1)], Ok(-1.1)),
+            // MODE(C9,E16,"1",B8): E16 holds the text "1.1".
+            (vec![rf(nv(1.1)), rf(tv("1.1")), t("1"), rf(nv(1.0))], Err(CellError::NA)),
+            (vec![rf(nv(1.0)), t("1"), n(2.0), n(3.0)], Err(CellError::NA)),
+            (vec![t("1"), n(1.0), e(CellError::Div0), n(2.0), n(3.0)], Err(CellError::Div0)),
+            // MODE(B9,2,D7) with D7 blank.
+            (vec![rf(nv(2.0)), n(2.0), rf(Value::Empty)], Err(CellError::Value)),
+            (vec![n(1.0), n(1.0), e(CellError::Div0), t("1")], Err(CellError::Div0)),
+        ];
+        for name in ["MODE", "MODE.SNGL"] {
+            for (args, want) in &cases {
+                match want {
+                    Ok(x) => close(ev(name, args.clone()), *x),
+                    Err(err) => is_err(ev(name, args.clone()), *err),
+                }
+            }
+        }
+        is_err(ev("MODE.MULT", vec![rf(nv(1.0)), t("1"), rf(Value::Empty)]), CellError::Value);
+    }
+
+    /// Text and logical values typed as arguments are skipped, not coerced (Excel 365, #736).
+    #[test]
+    fn mode_skips_typed_text_and_logicals() {
+        let cases: Vec<(Vec<crate::Arg>, Result<f64, CellError>)> = vec![
+            (vec![n(1.0), n(1.0), t("x")], Ok(1.0)),
+            (vec![n(1.0), n(2.0), t("x")], Err(CellError::NA)),
+            (vec![n(1.0), t("1"), n(2.0), n(3.0)], Err(CellError::NA)),
+            (vec![t("1"), n(1.0), n(2.0), n(3.0)], Err(CellError::NA)),
+            (vec![t("1"), n(1.0), e(CellError::Div0), n(2.0), n(3.0)], Err(CellError::Div0)),
+            (vec![n(1.0), b(true), b(true), n(2.0)], Err(CellError::NA)),
+            (vec![n(1.0), n(1.0), b(true)], Ok(1.0)),
+        ];
+        for name in ["MODE", "MODE.SNGL"] {
+            for (args, want) in &cases {
+                match want {
+                    Ok(x) => close(ev(name, args.clone()), *x),
+                    Err(err) => is_err(ev(name, args.clone()), *err),
+                }
+            }
+        }
+        assert_eq!(rows_of(&ev("MODE.MULT", vec![n(1.0), t("1"), n(1.0), t("x")])), vec![vec![nv(1.0)]]);
+        is_err(ev("MODE.MULT", vec![n(1.0), b(true), b(true), n(2.0)]), CellError::NA);
+    }
+
     #[test]
     fn spread() {
         let d = [1345.0, 1301.0, 1368.0, 1322.0, 1310.0, 1370.0, 1318.0, 1350.0, 1303.0, 1299.0];
@@ -2415,7 +2499,10 @@ mod tests {
         let p = c(&[0.2, 0.3, 0.1, 0.4]);
         close(ev("PROB", vec![x.clone(), p.clone(), n(2.0)]), 0.1);
         close(ev("PROB", vec![x.clone(), p, n(1.0), n(3.0)]), 0.8);
-        is_err(ev("PROB", vec![x, c(&[0.5, 0.5, 0.5, 0.5]), n(1.0)]), CellError::Num);
+        is_err(ev("PROB", vec![x.clone(), c(&[0.5, 0.5, 0.5, 0.5]), n(1.0)]), CellError::Num);
+        // Excel: any probability <= 0 is #NUM!, even when it sums to one and lies outside the limits.
+        is_err(ev("PROB", vec![x.clone(), c(&[0.5, 0.0, 0.25, 0.25]), n(0.0), n(3.0)]), CellError::Num);
+        is_err(ev("PROB", vec![x, c(&[0.5, 0.0, 0.25, 0.25]), n(2.0), n(3.0)]), CellError::Num);
     }
 
     #[test]

crates/functions/src/text.rs

@@ -1,11 +1,12 @@
 //! Text functions.
 
-use gridcraft_core::parse::parse_number_text;
+use gridcraft_core::parse::parse_number_text_in;
 use gridcraft_core::{CellError, Value, number_to_text};
 
 use crate::criteria::wildcard_find;
 use crate::util::{
-    A, MAX_TEXT, R, S, arg, array_val, as_array, boolean, has, num, num_val, opt_bool, opt_int, opt_num, round_half_away, scalar, text, text_val,
+    A, MAX_CELLS, MAX_TEXT, R, S, arg, array_val, as_array, boolean, has, num, num_val, opt_bool, opt_int, opt_num, round_half_away, scalar, text,
+    text_val,
 };
 use crate::{Arg, Ctx, FnSpec, VAR};
 
@@ -214,7 +215,7 @@ fn find_impl(a: &[Arg], wild: bool) -> R<Value> {
     let hay = text(a, 1)?;
     let start = opt_num(a, 2, 1.0)?;
     let hc = chars(&hay);
-    if (start.is_nan() || start < 1.0) || start > hc.len() as f64 + 1.0 {
+    if (start.is_nan() || start < 1.0) || start > hc.len().max(1) as f64 {
         return Err(CellError::Value);
     }
     let start = start as usize - 1;
@@ -292,22 +293,19 @@ fn unicode(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     num_val(ch as u32 as f64)
 }
 
-fn value(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
+/// VALUE: a blank cell reads as 0, but empty or blank text is not a number (observed:
+/// `VALUE("")` is `#VALUE!`).
+fn value(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
     match scalar(arg(a, 0)?) {
         Value::Number(n) => num_val(n),
         Value::Empty => num_val(0.0),
         Value::Error(e) => Err(e),
-        Value::Text(t) => {
-            if t.trim().is_empty() {
-                return num_val(0.0);
-            }
-            parse_number_text(&t).ok_or(CellError::Value).and_then(num_val)
-        }
+        Value::Text(t) => parse_number_text_in(&t, c.date_system()).ok_or(CellError::Value).and_then(num_val),
         _ => Err(CellError::Value),
     }
 }
 
-fn numbervalue(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
+fn numbervalue(a: &[Arg], c: &mut dyn Ctx) -> R<Value> {
     let s = text(a, 0)?;
     let dec = if a.len() > 1 { text(a, 1)?.chars().next().ok_or(CellError::Value)? } else { '.' };
     let grp = if a.len() > 2 { text(a, 2)?.chars().next().ok_or(CellError::Value)? } else { ',' };
@@ -340,7 +338,7 @@ fn numbervalue(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
             out.push(c);
         }
     }
-    let mut n = parse_number_text(&out).ok_or(CellError::Value)?;
+    let mut n = parse_number_text_in(&out, c.date_system()).ok_or(CellError::Value)?;
     for _ in 0..pct {
         n /= 100.0;
     }
@@ -613,6 +611,9 @@ fn textsplit(a: &[Arg], _c: &mut dyn Ctx) -> R<Value> {
     }
     let ncols = rows.iter().map(Vec::len).max().unwrap_or(1).max(1);
     let nrows = rows.len();
+    if nrows.saturating_mul(ncols) > MAX_CELLS {
+        return Err(CellError::Num);
+    }
     let mut data = Vec::with_capacity(nrows * ncols);
     for r in rows {
         let n = r.len();
@@ -844,6 +845,7 @@ pub(crate) fn specs() -> Vec<FnSpec> {
             fixed
         ),
         f!("DOLLAR", 1, 2, Text, S, "DOLLAR(number, [decimals])", "Formats a number as currency text.", dollar),
+        f!("USDOLLAR", 1, 2, Compatibility, S, "USDOLLAR(number, [decimals])", "Formats a number as currency text, like DOLLAR.", dollar),
         f!("BAHTTEXT", 1, 1, Text, S, "BAHTTEXT(number)", "Spells out a number in Thai words with Baht.", bahttext),
         f!("T", 1, 1, Text, S, "T(value)", "Returns the value if it is text, otherwise empty text.", t_fn),
         f!(
@@ -1035,6 +1037,15 @@ mod tests {
         close(ev("SEARCH", vec![t("~*"), t("a*b")]), 2.0);
         is_err(ev("SEARCH", vec![t("z"), t("abc")]), CellError::Value);
         is_err(ev("SEARCH", vec![t("a"), t("abc"), n(5.0)]), CellError::Value);
+        close(ev("SEARCH", vec![t("b"), t("\u{130}b")]), 2.0);
+        close(ev("SEARCH", vec![t("B"), t("\u{130}b")]), 2.0);
+        close(ev("SEARCH", vec![t("b?"), t("a\u{130}bc")]), 3.0);
+        close(ev("SEARCH", vec![t("i"), t("a\u{130}bc")]), 2.0);
+        is_err(ev("SEARCH", vec![t("b"), t("a\u{130}bc"), n(4.0)]), CellError::Value);
+        for f in ["FIND", "SEARCH"] {
+            close(ev(f, vec![t(""), t("abc"), n(3.0)]), 3.0);
+            is_err(ev(f, vec![t(""), t("abc"), n(4.0)]), CellError::Value);
+        }
         assert_eq!(ev("EXACT", vec![t("a"), t("A")]), Value::Bool(false));
         assert_eq!(ev("EXACT", vec![t("a"), t("a")]), Value::Bool(true));
     }
@@ -1054,6 +1065,25 @@ mod tests {
         is_err(ev("UNICHAR", vec![n(55296.0)]), CellError::NA);
     }
 
+    /// VALUE cases observed in Excel (ValueFunctionOfBlank, FormulaEvalTestData); a blank cell
+    /// still reads as 0.
+    #[test]
+    fn value_observed() {
+        let cases: Vec<(crate::Arg, Result<f64, CellError>)> = vec![
+            (t(""), Err(CellError::Value)),
+            (t("ABC"), Err(CellError::Value)),
+            (t("0.33"), Ok(0.33)),
+            (t("$1,000"), Ok(1000.0)),
+            (rf(Value::Empty), Ok(0.0)),
+        ];
+        for (arg, want) in cases {
+            match want {
+                Ok(x) => close(ev("VALUE", vec![arg]), x),
+                Err(err) => is_err(ev("VALUE", vec![arg]), err),
+            }
+        }
+    }
+
     #[test]
     fn numbers_from_text() {
         close(ev("VALUE", vec![t("1,234.5")]), 1234.5);
@@ -1075,6 +1105,8 @@ mod tests {
         is_text(ev("DOLLAR", vec![n(1234.567)]), "$1,234.57");
         is_text(ev("DOLLAR", vec![n(-1234.567), n(1.0)]), "($1,234.6)");
         is_text(ev("DOLLAR", vec![n(0.5), n(0.0)]), "$1");
+        is_text(ev("USDOLLAR", vec![n(1.0)]), "$1.00");
+        is_text(ev("USDOLLAR", vec![n(-1234.567), n(1.0)]), "($1,234.6)");
         is_text(ev("T", vec![t("x")]), "x");
         is_text(ev("T", vec![n(1.0)]), "");
     }
@@ -1117,6 +1149,13 @@ mod tests {
         assert_eq!(rows_of(&v)[1], vec![tv("c"), tv("-")]);
     }
 
+    #[test]
+    fn split_rejects_oversized_padded_grid() {
+        // One row of 8000 columns followed by 8000 one-cell rows: the text is under the cell-text limit, the padded grid is not.
+        let text = format!("{}{}", "a,".repeat(8000), "b;".repeat(8000));
+        is_err(ev("TEXTSPLIT", vec![t(&text), t(","), t(";")]), CellError::Num);
+    }
+
     #[test]
     fn to_text() {
         is_text(ev("VALUETOTEXT", vec![t("a\"b")]), "a\"b");

crates/mcp/src/tests.rs

@@ -202,6 +202,9 @@ fn basic_tools() {
     assert!(f.as_array().unwrap().iter().any(|x| x["name"] == "VLOOKUP"));
     assert_eq!(ok(&mut s, "evaluate_formula", json!({"formula": "SUM(1,2,3)"}))["result"], json!(6.0));
     ok(&mut s, "set_cell", json!({"cell": "A1", "input": "5"}));
+    // #697: a number for `input` is entered, not rejected or cleared.
+    ok(&mut s, "set_cell", json!({"cell": "B1", "input": 42.5}));
+    assert_eq!(ok(&mut s, "get_cell", json!({"cell": "B1"}))["value"], json!(42.5));
     ok(&mut s, "execute_command", json!({"command": "cell.set", "params": {"cell": "A2", "input": "=A1*2"}}));
     assert_eq!(ok(&mut s, "get_cell", json!({"cell": "A2"}))["value"], json!(10.0));
     assert_eq!(ok(&mut s, "evaluate_formula", json!({"formula": "=A1+A2", "cell": "C1"}))["result"], json!(15.0));
@@ -517,3 +520,29 @@ fn text_to_columns_destination_follows_its_sheet() {
     cmd_fails(&mut s, "data.textToColumns", json!({"range": "Other!A1", "delimiters": [","], "destination": "D0"}));
     cmd_fails(&mut s, "data.textToColumns", json!({"range": "Other!A1", "delimiters": [","], "destination": "Sheet1!D1"}));
 }
+
+#[test]
+fn invalid_borders_are_invalid_params() {
+    let mut s = server();
+    let bad = |s: &mut Server, id: u64, borders: Value| {
+        let v = rpc(s, id, "tools/call", json!({"name": "format_range", "arguments": {"range": "A1", "borders": borders}}));
+        assert_eq!(err_code(&v), -32602, "{v}");
+    };
+    bad(&mut s, 1, json!(123));
+    bad(&mut s, 2, json!("bogus"));
+    bad(&mut s, 3, json!({"preset": "bogus"}));
+    bad(&mut s, 4, json!({"style": "thick"}));
+    ok(&mut s, "format_range", json!({"range": "A1", "borders": "all"}));
+    ok(&mut s, "format_range", json!({"range": "B1", "borders": {"preset": "all", "style": "thick", "color": "#123456"}}));
+}
+
+#[test]
+fn invalid_sort_keys_are_invalid_params() {
+    let mut s = server();
+    ok(&mut s, "write_range", json!({"range": "A1", "values": [["b"], ["c"], ["a"]]}));
+    for (id, keys) in [(1, json!([123])), (2, json!([{"order": "desc"}])), (3, json!([{"column": "A", "order": "sideways"}]))] {
+        let v = rpc(&mut s, id, "tools/call", json!({"name": "sort_range", "arguments": {"range": "A1:A3", "keys": keys}}));
+        assert_eq!(err_code(&v), -32602, "{v}");
+    }
+    ok(&mut s, "sort_range", json!({"range": "A1:A3", "keys": ["A", {"column": "A", "order": "desc"}]}));
+}

crates/mcp/src/tools.rs

@@ -180,7 +180,7 @@ pub fn tool_definitions() -> Vec<Value> {
             "Enter one cell exactly as if typed: a number, text, or a formula starting with = (\"=AVERAGE(B2:B9)\"). \
              Dependent cells recalculate. Returns the command result; use get_cell to read the computed value.",
             obj(
-                json!({"cell": string("Cell, e.g. \"B7\" or \"Sheet2!C3\""), "input": string("Typed input: number, text or =formula")}),
+                json!({"cell": string("Cell, e.g. \"B7\" or \"Sheet2!C3\""), "input": {"type": ["string", "number", "boolean"], "description": "Typed input: number, text or =formula"}}),
                 &["cell", "input"],
             ),
             false,
@@ -391,8 +391,41 @@ fn type_matches(t: &str, v: &Value) -> bool {
     }
 }
 
-/// Validates `args` against the tool's schema: unknown tool, missing required properties and
-/// top-level type mismatches are JSON-RPC "invalid params" errors.
+/// Checks a value against a (sub)schema: `type`, `enum`, `oneOf`, array `items`, and for objects the required and known properties.
+fn schema_matches(schema: &Value, v: &Value) -> bool {
+    if let Some(t) = schema["type"].as_str()
+        && !type_matches(t, v)
+    {
+        return false;
+    }
+    if let Some(allowed) = schema["enum"].as_array()
+        && !allowed.contains(v)
+    {
+        return false;
+    }
+    if let Some(alts) = schema["oneOf"].as_array()
+        && !alts.iter().any(|alt| schema_matches(alt, v))
+    {
+        return false;
+    }
+    if let Some(xs) = v.as_array()
+        && !xs.iter().all(|x| schema_matches(&schema["items"], x))
+    {
+        return false;
+    }
+    if let Some(o) = v.as_object() {
+        if schema["required"].as_array().into_iter().flatten().filter_map(Value::as_str).any(|r| o.get(r).is_none_or(Value::is_null)) {
+            return false;
+        }
+        if let Some(props) = schema["properties"].as_object() {
+            return o.iter().all(|(k, x)| props.get(k).is_some_and(|ps| x.is_null() || schema_matches(ps, x)));
+        }
+    }
+    true
+}
+
+/// Validates `args` against the tool's schema: unknown tool, missing required properties,
+/// top-level type mismatches and values matching none of a `oneOf` are JSON-RPC "invalid params" errors.
 pub(crate) fn check_arguments(name: &str, args: &Value) -> Result<(), String> {
     let defs = tool_definitions();
     let def = defs.iter().find(|d| d["name"] == name).ok_or_else(|| format!("unknown tool `{name}`"))?;
@@ -421,6 +454,9 @@ pub(crate) fn check_arguments(name: &str, args: &Value) -> Result<(), String> {
         {
             return Err(format!("{name}: `{k}` must be one of {}", Value::Array(allowed.clone())));
         }
+        if (p["oneOf"].is_array() || p["items"]["oneOf"].is_array()) && !schema_matches(p, v) {
+            return Err(format!("{name}: argument `{k}` does not match the schema: {}", p["description"]));
+        }
     }
     Ok(())
 }

crates/model/src/cellmap.rs

@@ -43,7 +43,7 @@ mod tests {
                 dates: vec![],
             },
         );
-        s.hyperlinks.insert(c3, Hyperlink { target: "Sheet1!A1".into(), tooltip: Some("jump".into()) });
+        s.hyperlinks.insert(c3, Hyperlink { target: "Sheet1!A1".into(), tooltip: Some("jump".into()), external: false });
         let json = serde_json::to_string(&s).expect("serialize");
         let back: Sheet = serde_json::from_str(&json).expect("deserialize");
         assert_eq!(back.comments, s.comments);

crates/model/src/features.rs

@@ -48,6 +48,23 @@ pub struct TableColumn {
     pub totals_label: Option<String>,
     /// Calculated column formula.
     pub formula: Option<String>,
+    /// `uniqueName`: the name XML maps know the column by.
+    #[serde(default)]
+    pub unique_name: Option<String>,
+    /// Binding to an element of an XML map. It moves with the column and goes when the column is
+    /// deleted; inserted columns are unmapped.
+    #[serde(default)]
+    pub xml: Option<XmlColumnPr>,
+}
+
+/// A table column's binding to an XML map (`<xmlColumnPr>`).
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct XmlColumnPr {
+    pub map_id: u32,
+    pub xpath: String,
+    /// `xmlDataType` as written in the file (`string`, `boolean`, `integer`…).
+    pub data_type: String,
+    pub denormalized: bool,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -65,6 +82,17 @@ pub struct Table {
     pub first_col: bool,
     pub last_col: bool,
     pub filter_button: bool,
+    /// Criteria of the table's AutoFilter (column offset within the table → criterion). With
+    /// criteria present, hidden data rows are filtered out rather than hidden by hand, which
+    /// SUBTOTAL distinguishes.
+    #[serde(default)]
+    pub filter: Vec<(u32, FilterCriterion)>,
+    /// `tableType` when it isn't a plain worksheet table: `xml` for a table bound to an XML map.
+    #[serde(default)]
+    pub table_type: Option<String>,
+    /// The connection (`xl/connections.xml`) an XML table is bound through.
+    #[serde(default)]
+    pub connection_id: Option<u32>,
 }
 
 impl Table {
@@ -299,9 +327,14 @@ pub struct Comment {
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Hyperlink {
-    /// URL, `mailto:`, or an in-workbook location like `Sheet2!A1`.
+    /// URL, `mailto:`, a file path (`Book.xlsx`, `Book.xlsx#Sheet1!A2`), or an in-workbook location
+    /// like `Sheet2!A1`.
     pub target: String,
     pub tooltip: Option<String>,
+    /// The target is outside this workbook (Excel's "Existing File or Web Page"): a relationship in
+    /// the file, not a `location`. A bare file name can't be told from a defined name by its text.
+    #[serde(default)]
+    pub external: bool,
 }
 
 // ---------------------------------------------------------------- drawing objects
@@ -388,6 +421,65 @@ pub struct Series {
     /// Draw line segments as a smoothed (spline) curve.
     #[serde(default)]
     pub smooth: bool,
+    /// Trendlines fitted to this series (Excel allows several per series).
+    #[serde(default)]
+    pub trendlines: Vec<Trendline>,
+}
+
+/// Regression a trendline fits (`c:trendlineType`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum TrendlineKind {
+    #[default]
+    Linear,
+    /// `y = c·e^(b·x)`.
+    Exponential,
+    /// `y = c·ln(x) + b`.
+    Logarithmic,
+    /// Polynomial of this order (2..=6).
+    Polynomial(u8),
+    /// `y = c·x^b`.
+    Power,
+    /// Average of this many consecutive points (2..=255).
+    MovingAverage(u32),
+}
+
+/// DrawingML preset line dash (`a:prstDash`).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq, Serialize, Deserialize)]
+pub enum LineDash {
+    #[default]
+    Solid,
+    Dot,
+    Dash,
+    LgDash,
+    DashDot,
+    LgDashDot,
+    LgDashDotDot,
+    SysDash,
+    SysDot,
+    SysDashDot,
+    SysDashDotDot,
+}
+
+/// A chart trendline (Add Chart Element ▸ Trendline, Format Trendline pane).
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize)]
+pub struct Trendline {
+    pub kind: TrendlineKind,
+    /// Custom name shown in the legend; `None` = automatic ("Linear (Sales)").
+    pub name: Option<String>,
+    /// Forecast past the last point, in x units (categories on a category axis).
+    pub forward: f64,
+    /// Forecast before the first point, in x units.
+    pub backward: f64,
+    /// Set Intercept: fixed y at x = 0 (linear, exponential, polynomial).
+    pub intercept: Option<f64>,
+    pub display_equation: bool,
+    pub display_r_squared: bool,
+    /// Line colour; `None` = the series colour.
+    pub color: Option<Color>,
+    /// Line width in points; `None` = default.
+    pub width: Option<f32>,
+    /// Line dash; `None` = default.
+    pub dash: Option<LineDash>,
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -534,6 +626,12 @@ pub enum FilterCriterion {
     AboveAverage(bool),
     FillColor(Color),
     FontColor(Color),
+    /// Rows whose cell shows icon `id` (0-based; `None` = no icon) of conditional-format icon set
+    /// `set` (`iconFilter`). Kept from files; re-applying the filter leaves those rows as they are.
+    Icon {
+        set: String,
+        id: Option<u32>,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
@@ -905,6 +1003,12 @@ pub struct PivotTable {
     pub last_range: Option<RangeRef>,
     /// Calculated fields, usable in the Values area by name.
     pub calculated_fields: Vec<PivotCalcField>,
+    /// The Σ Values pseudo-field (it exists with two or more value fields) sits in Rows rather
+    /// than Columns (Excel's "values on rows").
+    pub values_on_rows: bool,
+    /// Position of Σ Values among the row fields (`None` = after the last). Only used with
+    /// `values_on_rows`: in Columns Σ Values always comes after the last column field.
+    pub values_position: Option<usize>,
 }
 
 /// A calculated field: a formula over other fields (`=Sales*0.1`, `='Unit Price'*Units`). As in
@@ -937,6 +1041,8 @@ impl Default for PivotTable {
             show_headers: true,
             last_range: None,
             calculated_fields: vec![],
+            values_on_rows: false,
+            values_position: None,
         }
     }
 }

crates/model/src/lib.rs

@@ -18,8 +18,8 @@ pub mod workbook;
 pub use cell::{Cell, CellPicture, Formula};
 pub use features::*;
 pub use password::PasswordHash;
-pub use preserved::{Preserved, PreservedPart, PreservedRel, PreservedXml};
-pub use sheet::{DEFAULT_COL_WIDTH, DEFAULT_ROW_HEIGHT, LineIndex, Sheet, SheetViewMode, Visibility};
+pub use preserved::{Preserved, PreservedPart, PreservedRel, PreservedSheet, PreservedXml};
+pub use sheet::{DEFAULT_COL_WIDTH, DEFAULT_ROW_HEIGHT, LineIndex, Sheet, SheetViewMode, Visibility, points_to_chars};
 pub use store::CellStore;
 pub use style::{
     Alignment, BorderLine, BorderStyle, Borders, Color, Fill, Font, HAlign, NumFmt, PatternType, Style, StyleId, StyleTable, Theme, Underline,

crates/model/src/preserved.rs

@@ -7,6 +7,8 @@
 
 use std::sync::Arc;
 
+use crate::sheet::Visibility;
+
 /// A relationship from an owning part (the package root, the workbook or a sheet, or a kept part)
 /// to a kept part or to an external target.
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
@@ -33,15 +35,29 @@ pub struct PreservedPart {
 }
 
 /// A raw XML element of an owning part that refers to kept parts, re-emitted on save with its
-/// relationship ids rewritten.
+/// relationship ids rewritten, or that Excel needs back unchanged (the workbook's `fileVersion`).
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct PreservedXml {
-    /// Which slot of the owner it belongs in (`externalReferences`, `oleObjects`, `controls`).
+    /// Which slot of the owner it belongs in (`externalReferences`, `fileVersion`, `ext`,
+    /// `oleObjects`, `controls`).
     pub slot: String,
     /// The element, namespace declarations it needs included.
     pub xml: String,
 }
 
+/// A chart sheet (a sheet that holds one chart and no cells) kept as it was in the source file. Its
+/// part, drawing, chart, style and colour parts are in [`Preserved::parts`]; the workbook
+/// relationship to it is in [`Preserved::rels`].
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct PreservedSheet {
+    pub name: String,
+    pub visibility: Visibility,
+    /// The id of the workbook relationship to the chart sheet part, in the source file.
+    pub rel_id: String,
+    /// How many worksheets come before it: its position among the model's sheets.
+    pub before: usize,
+}
+
 /// Unmodelled content kept for one owner (the workbook, which also holds package-root content,
 /// or one sheet).
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
@@ -57,11 +73,18 @@ pub struct Preserved {
     /// The sheet's legacy VML drawing when kept elements need its shapes (form controls, OLE
     /// objects). Its own relationships point into `parts`.
     pub vml: Option<PreservedPart>,
+    /// Chart sheets, in file order (workbook owner only).
+    pub sheets: Vec<PreservedSheet>,
 }
 
 impl Preserved {
     pub fn is_empty(&self) -> bool {
-        self.package_rels.is_empty() && self.rels.is_empty() && self.parts.is_empty() && self.elements.is_empty() && self.vml.is_none()
+        self.package_rels.is_empty()
+            && self.rels.is_empty()
+            && self.parts.is_empty()
+            && self.elements.is_empty()
+            && self.vml.is_none()
+            && self.sheets.is_empty()
     }
     /// Total bytes held.
     pub fn byte_len(&self) -> usize {

crates/model/src/sheet.rs

@@ -117,6 +117,12 @@ pub struct Sheet {
 pub const DEFAULT_COL_WIDTH: f32 = 64.0;
 pub const DEFAULT_ROW_HEIGHT: f32 = 20.0;
 
+/// Column width (points) → characters of the default font's digit width (7 px), without the
+/// cell padding: the value the Column Width dialog shows.
+pub fn points_to_chars(px: f64) -> f64 {
+    if px <= 12.0 { (px / 12.0 * 100.0).round() / 100.0 } else { ((px - 5.0) / 7.0 * 100.0 + 0.5).trunc() / 100.0 }
+}
+
 impl Sheet {
     pub fn new(name: impl Into<String>) -> Sheet {
         Sheet {
@@ -221,6 +227,20 @@ impl Sheet {
 
     // ---- geometry
 
+    /// Whether this cell has a table or ordinary AutoFilter dropdown.
+    pub fn has_filter_button(&self, c: CellRef) -> bool {
+        self.autofilter.as_ref().is_some_and(|af| af.range.start.row == c.row && af.range.contains(c))
+            || self.tables.iter().any(|t| t.filter_button && t.header_row && t.range.start.row == c.row && t.range.contains(c))
+    }
+
+    /// Horizontal header space in unzoomed grid units (96 units per inch).
+    /// Observed in Windows Excel 16.0 build 20326: AutoFit reserves 12.5 pt at
+    /// 100-200% zoom, 25 pt at 50%, regardless of header row height. Below 100%
+    /// the dropdown keeps its screen width. This is geometry, not font padding.
+    pub fn filter_button_space(&self, c: CellRef) -> f32 {
+        if self.has_filter_button(c) { (12.5 * 96.0 / 72.0) / (self.zoom as f32 / 100.0).clamp(0.1, 1.0) } else { 0.0 }
+    }
+
     pub fn col_width(&self, col: u32) -> f32 {
         match self.cols.get(&col) {
             Some(i) if i.hidden => 0.0,
@@ -238,6 +258,17 @@ impl Sheet {
     pub fn is_row_hidden(&self, row: u32) -> bool {
         self.rows.get(&row).is_some_and(|r| r.hidden)
     }
+    /// Whether `row` is hidden by an applied filter: a hidden row below the header of the
+    /// sheet AutoFilter while it has criteria, or a hidden data row of a filtered table.
+    /// Other hidden rows were hidden by hand.
+    pub fn is_row_filtered(&self, row: u32) -> bool {
+        if !self.is_row_hidden(row) {
+            return false;
+        }
+        let in_sheet_filter =
+            self.autofilter.as_ref().is_some_and(|af| !af.criteria.is_empty() && row > af.range.start.row && row <= af.range.end.row);
+        in_sheet_filter || self.tables.iter().any(|t| !t.filter.is_empty() && t.data_range().is_some_and(|r| row >= r.start.row && row <= r.end.row))
+    }
     pub fn is_col_hidden(&self, col: u32) -> bool {
         self.cols.get(&col).is_some_and(|r| r.hidden)
     }

crates/model/src/style.rs

@@ -377,6 +377,12 @@ impl Default for StyleTable {
 }
 
 impl StyleTable {
+    /// A table whose default (Normal) style is `normal`, such as a file's own Normal font.
+    pub fn with_default(normal: Style) -> Self {
+        let mut index = HashMap::new();
+        index.insert(normal.clone(), StyleId::DEFAULT);
+        StyleTable { styles: vec![normal], index }
+    }
     pub fn get(&self, id: StyleId) -> &Style {
         self.styles.get(id.0 as usize).or_else(|| self.styles.first()).unwrap_or(&DEFAULT_STYLE)
     }

crates/model/src/workbook.rs

@@ -18,11 +18,16 @@ pub enum CalcMode {
     Manual,
 }
 
+/// File › Options › Formulas › Calculation options, stored per workbook (`<calcPr>`).
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct CalcSettings {
     pub mode: CalcMode,
+    /// Enable iterative calculation: circular references are calculated repeatedly instead of
+    /// reporting an error.
     pub iterative: bool,
+    /// Maximum Iterations, 1 to [`CalcSettings::MAX_ITERATIONS`].
     pub max_iterations: u32,
+    /// Maximum Change: iteration stops once no value in a circular reference changes by more.
     pub max_change: f64,
     /// Use precision as displayed.
     pub precision_as_displayed: bool,
@@ -30,7 +35,32 @@ pub struct CalcSettings {
 
 impl Default for CalcSettings {
     fn default() -> Self {
-        CalcSettings { mode: CalcMode::Automatic, iterative: false, max_iterations: 100, max_change: 0.001, precision_as_displayed: false }
+        CalcSettings {
+            mode: CalcMode::Automatic,
+            iterative: false,
+            max_iterations: Self::DEFAULT_ITERATIONS,
+            max_change: Self::DEFAULT_CHANGE,
+            precision_as_displayed: false,
+        }
+    }
+}
+
+impl CalcSettings {
+    pub const DEFAULT_ITERATIONS: u32 = 100;
+    pub const DEFAULT_CHANGE: f64 = 0.001;
+    /// The largest Maximum Iterations Excel accepts.
+    pub const MAX_ITERATIONS: u32 = 32_767;
+
+    /// Sets Maximum Iterations, kept within 1 to [`CalcSettings::MAX_ITERATIONS`].
+    pub fn set_max_iterations(&mut self, n: u32) {
+        self.max_iterations = n.clamp(1, Self::MAX_ITERATIONS);
+    }
+
+    /// Sets Maximum Change (its magnitude); a value that isn't finite is ignored.
+    pub fn set_max_change(&mut self, d: f64) {
+        if d.is_finite() {
+            self.max_change = d.abs();
+        }
     }
 }
 
@@ -79,9 +109,17 @@ pub struct Workbook {
     /// macros it arrived with. base64 in JSON. `None` = the workbook has no macros.
     #[serde(default, with = "crate::b64::opt")]
     pub vba_project: Option<Vec<u8>>,
+    /// Field separator of the CSV this workbook was read from, so saving it as CSV writes the same
+    /// separator back (a `;` file stays a `;` file). `None` = not read from CSV: CSV saves use `,`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub csv_delimiter: Option<u8>,
     /// Unmodelled file content kept for saving (package root and workbook level). Not in JSON.
     #[serde(skip)]
     pub preserved: Option<Arc<crate::preserved::Preserved>>,
+    /// The folder the workbook was read from, which relative paths to linked workbooks in
+    /// `preserved` are relative to. Saving into another folder rewrites them from there. Not in JSON.
+    #[serde(skip)]
+    pub source_dir: Option<std::path::PathBuf>,
 }
 
 impl Default for Workbook {
@@ -107,7 +145,9 @@ impl Workbook {
             custom_lists: vec![],
             cell_styles: vec![],
             vba_project: None,
+            csv_delimiter: None,
             preserved: None,
+            source_dir: None,
         }
     }
     pub fn sheet(&self, i: usize) -> Option<&Sheet> {

crates/numfmt/src/lib.rs

@@ -98,13 +98,38 @@ impl Default for NumberFormat {
     }
 }
 
+/// Longest number format code, in characters (not bytes), that is parsed: Excel's own limit.
+/// A longer code is invalid: [`NumberFormat::parse`] returns a General format (the cell shows
+/// its value unformatted; the stored code is kept as is) and `TEXT` returns `#VALUE!`. The cap
+/// also bounds every allocation that scales with the number of placeholders in a code.
+pub const MAX_FORMAT_CODE_CHARS: usize = 255;
+
+/// True when `code` is longer than [`MAX_FORMAT_CODE_CHARS`] characters.
+fn too_long(code: &str) -> bool {
+    // A code of more than 255 bytes can still be short in characters; count only when needed.
+    code.len() > MAX_FORMAT_CODE_CHARS && code.chars().count() > MAX_FORMAT_CODE_CHARS
+}
+
 impl NumberFormat {
-    /// Parses a format code. Never fails: unknown or malformed parts degrade to literal text.
+    /// Parses a format code. Never fails: unknown or malformed parts degrade to literal text, and
+    /// a code longer than [`MAX_FORMAT_CODE_CHARS`] characters degrades to General.
     pub fn parse(code: &str) -> NumberFormat {
+        Self::parse_inner(code, false)
+    }
+
+    /// `parse` without the length cap, so tests can reach renderer paths a capped code cannot.
+    #[cfg(test)]
+    fn parse_uncapped(code: &str) -> NumberFormat {
+        Self::parse_inner(code, true)
+    }
+
+    fn parse_inner(code: &str, uncapped: bool) -> NumberFormat {
+        #[cfg(test)]
+        parse_cache::count_parse();
         let trimmed = code.trim();
         // `checkbox` marks a checkbox cell (Insert › Checkbox): TRUE/FALSE draw as a box, any other
         // value displays as General.
-        if trimmed.is_empty() || trimmed.eq_ignore_ascii_case("general") || trimmed == "checkbox" {
+        if trimmed.is_empty() || trimmed.eq_ignore_ascii_case("general") || trimmed == "checkbox" || (!uncapped && too_long(code)) {
             return NumberFormat {
                 inner: Arc::new(Inner { code: code.to_string(), general: true, sections: Vec::new(), num_sections: 0, text_section: None }),
             };
@@ -261,7 +286,8 @@ impl NumberFormat {
         let Some(mut out) = out else {
             return (Formatted { text: OVERFLOW.into(), color: sec.color, fill: None, numeric: true }, true);
         };
-        if minus && sec.kind != SecKind::Text {
+        // Excel drops the minus sign when the first section shows a negative number as all zeros.
+        if minus && sec.kind != SecKind::Text && !out.zero {
             out.prepend("-");
         }
         (Formatted { text: out.text, color: sec.color, fill: out.fill, numeric: true }, false)
@@ -294,18 +320,94 @@ pub fn format_value(v: &Value, fmt: &NumberFormat, sys: DateSystem) -> Formatted
     }
 }
 
+/// A small per-thread cache of parsed format codes for callers that format many values with the
+/// same code (`TEXT` over a range, chart labels). A parsed format depends on the code text only
+/// (the date system and values are applied when formatting), so the code is the whole key.
+mod parse_cache {
+    use std::cell::RefCell;
+    use std::collections::HashMap;
+
+    use super::NumberFormat;
+
+    /// Most codes kept per thread. A full cache is emptied, so memory stays bounded.
+    pub(super) const CAPACITY: usize = 64;
+    /// Longer codes are parsed every time and never stored.
+    pub(super) const MAX_CODE_LEN: usize = 256;
+
+    thread_local! {
+        static CACHE: RefCell<HashMap<String, NumberFormat>> = RefCell::new(HashMap::new());
+    }
+
+    pub(super) fn get(code: &str) -> NumberFormat {
+        if code.len() > MAX_CODE_LEN {
+            return NumberFormat::parse(code);
+        }
+        // Not usable (thread shutting down, re-entered): parse without the cache.
+        let cached = CACHE
+            .try_with(|c| {
+                let mut c = c.try_borrow_mut().ok()?;
+                if let Some(f) = c.get(code) {
+                    return Some(f.clone());
+                }
+                let f = NumberFormat::parse(code);
+                if c.len() >= CAPACITY {
+                    c.clear();
+                }
+                c.insert(code.to_string(), f.clone());
+                Some(f)
+            })
+            .ok()
+            .flatten();
+        cached.unwrap_or_else(|| NumberFormat::parse(code))
+    }
+
+    #[cfg(test)]
+    thread_local! {
+        static PARSES: std::cell::Cell<usize> = const { std::cell::Cell::new(0) };
+    }
+
+    #[cfg(test)]
+    pub(super) fn count_parse() {
+        let _ = PARSES.try_with(|p| p.set(p.get() + 1));
+    }
+
+    /// Parses done on this thread so far (tests only).
+    #[cfg(test)]
+    pub(super) fn parses() -> usize {
+        PARSES.try_with(std::cell::Cell::get).unwrap_or(0)
+    }
+
+    /// Empties this thread's cache (tests only).
+    #[cfg(test)]
+    pub(super) fn clear() {
+        let _ = CACHE.try_with(|c| c.borrow_mut().clear());
+    }
+}
+
+impl NumberFormat {
+    /// Like [`NumberFormat::parse`], but remembers recently parsed codes (per thread, bounded) so
+    /// formatting many values with one code parses it once. Same result as `parse`.
+    pub fn parse_cached(code: &str) -> NumberFormat {
+        parse_cache::get(code)
+    }
+}
+
 /// The `TEXT()` worksheet function: formats a value with a format code. Numeric text is
-/// converted to a number first; other text goes through the text section (or is returned as is).
+/// converted to a number first; other text and booleans (as `TRUE`/`FALSE`) go through the text
+/// section, or are returned as is.
 pub fn text_function(v: &Value, code: &str, sys: DateSystem) -> Result<String, CellError> {
     if code.is_empty() {
         return Ok(String::new());
     }
-    let fmt = NumberFormat::parse(code);
+    if too_long(code) {
+        return Err(CellError::Value);
+    }
+    let fmt = NumberFormat::parse_cached(code);
     let n = match v.scalar() {
         Value::Error(e) => return Err(e),
         Value::Empty => 0.0,
         Value::Number(n) => n,
-        Value::Bool(b) => return Ok(if b { "TRUE" } else { "FALSE" }.into()),
+        Value::Bool(b) => return Ok(fmt.format_text(if b { "TRUE" } else { "FALSE" }).text),
         Value::Text(t) => match gridcraft_core::parse::parse_number_text(&t) {
             Some(n) => n,
             None => return Ok(fmt.format_text(&t).text),

crates/numfmt/src/parse.rs

@@ -125,12 +125,20 @@ pub(crate) struct Section {
 }
 
 /// Splits a code into sections at unquoted, unescaped, unbracketed semicolons.
+///
+/// A `[` opens a bracket only when a `]` follows it; the bracket then runs to the next `]` (quotes
+/// inside it are not special), exactly as `tokenize` reads it. An unclosed `[` is a literal in both
+/// passes, so a later `;` still separates sections. Linear: each `[` either jumps over its bracket
+/// or, with no `]` left in the code, is a literal at once.
 fn split_sections(code: &str) -> Vec<String> {
+    let cs: Vec<char> = code.chars().collect();
+    let last_close = cs.iter().rposition(|&c| c == ']');
     let mut out = vec![String::new()];
     let mut quoted = false;
-    let mut bracket = false;
     let mut escape = false;
-    for c in code.chars() {
+    let mut i = 0usize;
+    while let Some(&c) = cs.get(i) {
+        i += 1;
         let cur = match out.last_mut() {
             Some(c) => c,
             None => break,
@@ -145,19 +153,22 @@ fn split_sections(code: &str) -> Vec<String> {
                 quoted = !quoted;
                 cur.push(c);
             }
-            '\\' | '_' | '*' if !quoted && !bracket => {
+            '\\' | '_' | '*' if !quoted => {
                 escape = true;
                 cur.push(c);
             }
-            '[' if !quoted => {
-                bracket = true;
+            '[' if !quoted && last_close.is_some_and(|l| l >= i) => {
+                // `i` is already past the `[`; the closing bracket is at or after it.
                 cur.push(c);
+                while let Some(&d) = cs.get(i) {
+                    i += 1;
+                    cur.push(d);
+                    if d == ']' {
+                        break;
+                    }
+                }
             }
-            ']' if !quoted => {
-                bracket = false;
-                cur.push(c);
-            }
-            ';' if !quoted && !bracket => {
+            ';' if !quoted => {
                 if out.len() >= MAX_SECTIONS {
                     break;
                 }
@@ -246,6 +257,8 @@ fn tokenize(src: &str) -> Raw {
     let cs: Vec<char> = src.chars().collect();
     let mut raw = Raw { toks: Vec::new(), color: None, cond: None, currency: false };
     let toks = &mut raw.toks;
+    // With no `]` at or after a `[`, that `[` is a literal; checking this once keeps the scan linear.
+    let last_close = cs.iter().rposition(|&c| c == ']');
     let mut i = 0usize;
     while let Some(&c) = cs.get(i) {
         match c {
@@ -290,7 +303,7 @@ fn tokenize(src: &str) -> Raw {
                 continue;
             }
             '[' => {
-                let close = cs.get(i + 1..).and_then(|r| r.iter().position(|&d| d == ']'));
+                let close = if last_close.is_some_and(|l| l > i) { cs.get(i + 1..).and_then(|r| r.iter().position(|&d| d == ']')) } else { None };
                 if let Some(p) = close {
                     let content: String = cs.get(i + 1..i + 1 + p).unwrap_or(&[]).iter().collect();
                     bracket(&mut raw_parts(toks, &mut raw.color, &mut raw.cond, &mut raw.currency), &content);
@@ -513,6 +526,20 @@ fn analyze(raw: Raw) -> Section {
     let mut seen_exp = false;
     let mut seen_digit = false;
     let mut fraction_slash = false;
+    // Precomputed so each comma and slash is O(1) (a long run of them stays linear): whether the
+    // first non-comma token after a position is a digit, and where the last exponent marker is.
+    let mut digit_after_commas = vec![false; toks.len()];
+    let mut after = false;
+    for (j, t) in toks.iter().enumerate().rev() {
+        if let Some(slot) = digit_after_commas.get_mut(j) {
+            *slot = after;
+        }
+        if !matches!(t, Tok::Comma) {
+            after = matches!(t, Tok::Digit(_));
+        }
+    }
+    let last_exp = toks.iter().rposition(|t| matches!(t, Tok::Exp { .. }));
+    let scientific = toks.iter().skip_while(|t| !matches!(t, Tok::Digit(_))).any(|t| matches!(t, Tok::Exp { .. }));
     for i in 0..toks.len() {
         let Some(t) = toks.get(i).cloned() else { break };
         let replace = match t {
@@ -542,11 +569,14 @@ fn analyze(raw: Raw) -> Section {
                 }
             }
             Tok::Comma => {
-                let next = toks.get(i + 1..).and_then(|s| s.iter().find(|t| !matches!(t, Tok::Comma)));
-                let next_digit = matches!(next, Some(Tok::Digit(_)));
+                let next_digit = digit_after_commas.get(i).copied().unwrap_or(false);
                 if seen_digit && next_digit && !seen_point && !seen_exp {
                     sec.thousands = true;
                     Some(Tok::Lit(String::new()))
+                } else if seen_digit && scientific {
+                    // Observed: a scientific section never scales; any other comma after the
+                    // first digit shows nothing (`#,e+#`, `#e+#,`, `#e+000,00`).
+                    Some(Tok::Lit(String::new()))
                 } else if seen_digit && !next_digit {
                     sec.scale += 1;
                     Some(Tok::Lit(String::new()))
@@ -555,8 +585,11 @@ fn analyze(raw: Raw) -> Section {
                 }
             }
             Tok::Slash => {
-                let next_ok = matches!(toks.get(i + 1), Some(Tok::Digit(_) | Tok::FixedDenom(_)));
-                let has_exp = toks.iter().any(|t| matches!(t, Tok::Exp { .. }));
+                // Literal text may sit between the bar and the denominator (`#/ #`, `# ?=/=?`).
+                let next_ok = matches!(toks.get(i + 1), Some(Tok::FixedDenom(_)))
+                    || matches!(toks.get(i + 1..).and_then(|s| s.iter().find(|t| !matches!(t, Tok::Lit(_)))), Some(Tok::Digit(_)));
+                // An exponent kept before this bar (`seen_exp`) or any marker still ahead of it.
+                let has_exp = seen_exp || last_exp.is_some_and(|l| l > i);
                 if !fraction_slash && seen_digit && next_ok && !seen_point && !has_exp {
                     fraction_slash = true;
                     sec.fraction = true;