iris/gridcraft
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: sync upstream (93 Commits) #17

Merged
alf merged 93 commits from chore/sync-upstream-20261105 into main 2026-11-05 22:04:50 +00:00
Conversation 0 Commits 93 Files changed 133 +9807 -755
alf commented 2026-11-05 22:04:49 +00:00
Owner
Copy link

Upstream-Sync von upstream/main (93 Commits). Fast-Forward.

  • 21b64df0 Paste of a whole-column or whole-row copy no longer aborts the app (#2018)
  • 292b784f fix(calc): apply "Set precision as displayed" in calculation (#1366)
  • c4029538 Merge pull request #3425 from ZIDAN44/fix/2874-german-insert-cells
  • 0a58f945 Merge remote-tracking branch 'origin/main' into pr
  • 6ea9f538 Merge pull request #2593 from helenkwok/web/host-page
  • 4e43ad88 UI: RefEdit follow-ups: a dialog keeps the sheet it was opened on, a click on the selected cell picks, quoted sheet names in Solver (#3180)
  • e06b2a7e gridcraft-web: speak the host messages through craft-web-host
  • bf6bee50 web host mode: refuse an oversized host file before copying it, cap the name, and document trust and limits
  • d628abb7 Web: page host mode, so a page can host GridCraft in its own document (#2592)
  • cb059716 i18n: German context menus' Insert reads "Zellen einfügen", not a second "Einfügen" (#2874)
  • 1fb19157 Charts: draw every doughnut series as a ring (#1827)
  • ede12f9d About: credits tables fit without side-scrolling and their columns resize (#3320)
  • 642980b7 Merge pull request #481 from prxnvt/pr/form-controls
  • 73fad546 Merge origin/main into pr/form-controls
  • 919a6b58 Merge pull request #2203 from Higgs32584/fix/2181-link-open-confirmation
Upstream-Sync von `upstream/main` (93 Commits). Fast-Forward. - 21b64df0 Paste of a whole-column or whole-row copy no longer aborts the app (#2018) - 292b784f fix(calc): apply "Set precision as displayed" in calculation (#1366) - c4029538 Merge pull request #3425 from ZIDAN44/fix/2874-german-insert-cells - 0a58f945 Merge remote-tracking branch 'origin/main' into pr - 6ea9f538 Merge pull request #2593 from helenkwok/web/host-page - 4e43ad88 UI: RefEdit follow-ups: a dialog keeps the sheet it was opened on, a click on the selected cell picks, quoted sheet names in Solver (#3180) - e06b2a7e gridcraft-web: speak the host messages through craft-web-host - bf6bee50 web host mode: refuse an oversized host file before copying it, cap the name, and document trust and limits - d628abb7 Web: page host mode, so a page can host GridCraft in its own document (#2592) - cb059716 i18n: German context menus' Insert reads "Zellen einfügen", not a second "Einfügen" (#2874) - 1fb19157 Charts: draw every doughnut series as a ring (#1827) - ede12f9d About: credits tables fit without side-scrolling and their columns resize (#3320) - 642980b7 Merge pull request #481 from prxnvt/pr/form-controls - 73fad546 Merge origin/main into pr/form-controls - 919a6b58 Merge pull request #2203 from Higgs32584/fix/2181-link-open-confirmation
alf added 93 commits 2026-11-05 22:04:49 +00:00 
link.open is reachable by the control channel, CLI, MCP and workbook
scripts, so it could open https://attacker/?d=<cell data> without the
user seeing it. By default (LinkPolicy::Confirm) it now refuses web and
e-mail addresses with an error and opens no dialog; references still
navigate and other schemes stay refused. A host may opt in with
LinkPolicy::Allow (Rust API only, no command sets it).

The UI's Open Hyperlink prompt no longer runs a command on OK: it calls
Session::open_confirmed_link with the address it showed, kept in a
private field, so ui.dialog.confirm can't press OK and ui.dialog.set
can't swap the address behind the prompt text.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`parse_streaming` counts every element it attaches to a parent against
MAX_XML_NODES, but the cells of a worksheet are attached to their `row`
while the row is open, and the row is then handed to the callback and
dropped. So the count grew with every cell of a sheet although the tree
never held more than one row, and a workbook with a sheet of about one
million ordinary cells (12,274 rows by 103 columns) was reported damaged
after 6,310 rows since #2413. Shared strings, streamed by `si`, had the
same exposure: a table of about a million plain strings, or fewer
rich-text ones.

The count now returns to its value at the start of a split element when
that element is handed out, so a streamed part of any size passes while a
part that keeps a million elements in its tree is still refused.
Regression test: 5,001 streamed rows of 100 cells are read whole; the same
part kept in a tree is refused.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Port the #2181 link.open confirmation changes into main's split files:
cmd/insert.rs -> cmd/insert/links.rs (open_link), dialogs.rs -> dialogs/show.rs
(OK handling, open_confirmed_link), grid.rs -> grid/interact.rs (follow_link doc).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The sheet tracked the selected object as a bare id in `selected_chart`, so
only charts and text boxes drew a selection frame, only the bottom-right
corner resized, and the kind of the selected object had to be guessed from
the id. The selection is now `SheetApp::selected_object: Option<ObjRef>`,
with `selected_chart()` kept for the Chart Design tab and the Format Chart
pane.

- Model: `ObjKind` (chart, image, shape, slicer) and `ObjRef { kind, id }`;
  `Sheet` helpers find, move and remove an object by `ObjRef` and walk every
  object's anchor in a fixed order. `next_object_id` saturates instead of
  overflowing on an id at `u32::MAX` read from a file.
- Commands: `object.delete`, `object.move` and `object.setAnchorMode` accept
  the four kinds through one parameter check, refuse an unknown kind or id
  instead of succeeding silently, and clamp hostile offsets. `object.delete`
  replies with the deleted object. Arrange and the Selection Pane include
  slicers, which stack above the other objects.
- Sheet: the selected object of any kind draws a frame with eight handles
  over every object. Each handle resizes only its own edges, which never
  cross; the body moves the object, and the first drag frame already applies
  the pointer's movement. The pointer shows the handle's resize cursor or a
  move cursor, with the diagonals swapped on a right-to-left sheet, where the
  frame moves with its object.
- Keys: Escape drops the object selection; Delete and Backspace keep
  deleting the selected object (#213). A selection whose object disappears
  (undo, redo, delete, sheet switch) is cleared.
- Double-click: `open_object` routes by kind (a text box edits in place, a
  chart opens Format Chart).
- Control protocol: `ui.inspect` reports `selectedObject {kind, id}` and
  keeps `selectedChart`; `ui.object.select` selects any object and replies
  with its rect. The snapshot example takes `--object <id>`.

Tests: engine tests for every kind by kind and id, the Selection Pane and
hostile parameters; UI tests for selecting each kind (a slicer over a chart
takes the click), all eight handles on four kinds, cursors, Delete,
Backspace and Escape, undo and redo, double-click routing, and resizing on a
right-to-left sheet. Existing tests use the new selection API.
Structural edits and sorts kept three hand-indexed lists (charts, images,
shapes) in step in two places, and slicers were left out of both, so a
slicer stayed put when rows were inserted above it. Chart series were
rewritten for inserted and deleted lines and for sheet renames, but not for
cut-moves or sheet deletes, which left them pointing at the old cells.

- Inserting and deleting rows and columns and sorting walk
  `Sheet::object_anchors` and `object_anchors_mut`, one fixed order over
  every kind, so slicers now follow their cells by their anchor mode like
  the other objects, and a new kind cannot be forgotten in one of the
  passes.
- `rewrite_cell_links` is the one place that rewrites the references
  floating objects hold (chart series values, categories and names,
  and the source block a chart was made from).
  `rewrite_all_formulas` calls it, which covers inserting and deleting
  lines and cells and cut-moves on one sheet or across sheets; renaming and
  deleting a sheet call it too, so a series into a deleted sheet becomes
  #REF!, as a formula does.
- Copying a sheet gives its charts, pictures, shapes and slicers fresh ids,
  keeping ids unique across the workbook, which object selection and the
  `{kind, id}` commands rely on.

Tests: every kind through row and column inserts and deletes, an absolute
shape, a sort and undo; a slicer through inserted rows; chart series
through a cut-move, a sheet rename, a sheet delete and undo; ids after a
sheet copy.
`rewrite_cell_links` rewrote a chart series' values, categories and name
but not its bubble sizes, so inserting or deleting lines, a cut-move or a
sheet rename left a bubble chart's sizes pointing at the old cells. They
are now rewritten with the rest.

Test: bubble sizes through an inserted row, a cut-move and a sheet rename.
A selected object's handles reach a few points outside it, and a press
was matched against them before any check of where it landed, so a press
on the column or row header beside an object at the sheet's edge resized
the object instead of selecting the column or row. The cursor already
ignored handles outside the cells.

`chartview::selected_handle` finds the selected object's handle under a
point only over the cell area, as `hit` does, and not while objects are
hidden; the press and the cursor both use it.

Test: presses within a handle's reach over the column header and the row
header neither move nor resize the object.
A drag merges its frames into one undo step by dropping a new step whose
label matches the one before it. Its first frame did the same, so a second
drag of an object (a move after a move, or a resize after a move) merged
into the first drag's "Move Object" step, and one undo took back both.

`Drag::Object` records whether the drag has made its step; only the later
frames of the same drag merge into it.

Test: a move and then a resize of a picture take two undos to reverse,
the first restoring the moved picture.
gaps.md (§4), target-app-parity.md (the Essentials tier's work, the
Mainstream chart row, the interaction discount and the Essentials chart
task) and chart-parity.md (the element table and the work list) still
described charts as impossible to resize (#190). Charts move and resize
from eight handles like every floating object, so those statements now
say so; the 2026-10-10 revision rows and the 10-10 re-check stay as
history. Scores and the 40-60 h chart estimate are unchanged (resizing
was 1-2 h, within the rounding).
gaps.md §4 carried two evidence paragraphs, an older one saying PRs #158
and #161 were open and a newer one saying all 2-D kinds survive XLSX round
trip, both repeating the resize, smooth-line, Switch Row/Column and
trendline statements. It is one paragraph with the current status again.

The Mainstream chart row in target-app-parity.md listed trendlines as
missing; they are read, written and drawn (`Series::trendlines`, the XLSX
chart reader and writer, `chart.addElement`), as chart-parity.md records.
The row now says so and keeps "no axis options". No score change.
A primary drag looked for a handle under the press on whatever object it
grabbed, so pressing near the edge or corner of an object that was not
selected started a resize, while the pointer over that spot showed the
Move cursor (handles are only shown, and only offered by the cursor, on
the selected object). The press now takes its handle from
`chartview::selected_handle`, the same lookup the cursor uses; a press on
any other object selects and moves it.

Test: dragging an unselected shape by its bottom-right corner shows the
Move cursor, then selects and moves the shape without resizing it.
A sheet holds form controls as floating objects of a new kind
(ObjKind::Control): buttons that run a macro or one command, and sliders
and spin buttons that hold a whole number from 0 to 30000 and write it
to a linked cell. They take part in everything other objects do: ids
from the workbook sequence, object.move, object.delete and
object.setAnchorMode, the Selection Pane and Bring Forward / Send
Backward, anchors that follow row and column edits, fresh ids on a
copied sheet, and links that follow inserts, deletes, cut-moves, sheet
renames and sheet deletes like chart series.

Commands (cmd/controls.rs): insert.button, insert.slider,
insert.spinButton, control.format, control.assign, control.setValue,
control.press and the control.list query. Each numeric rule (0 <= min <
max <= 30000, 1 <= step <= max - min, page >= step for sliders) is
refused with its own message, and values are clamped and snapped to the
step. control.setValue writes the linked cell through cell.set inside
one undo group, so dependents recalculate and one Undo restores both;
every commit moves linked controls to what their cells hold.

control.press runs a button's macro through macro.run, or its command
through the macro policy with the document's trust, so a button in a
workbook opened from a file asks before it runs anything. Like a macro
step, the command runs inside the scripts' file sandbox unless it is an
approved file command. Macros never press controls, and macro.rename
keeps buttons pointing at the renamed macro.

macro.run, macro.check and the debugger take `output`, which replaces
the macro's output anchor for that run (a button that sends the output
elsewhere). The policy and the approval go by the stored macro; the
footprint, the conflict rule and the per-step check work on the cells
`output` names. A value that isn't reference text of at most 1,024
characters, or names no cell, is refused before anything runs.
Buttons, scroll bars (sliders) and spin buttons are written the three
ways the published formats describe: a control properties part
(xl/ctrlProps/ctrlPropN.xml, formControlPr with objectType, fmlaLink,
min, max, inc, page, val and horiz), a <control> in the sheet's
<controls> inside mc:AlternateContent with its anchor, print and locked
flags and a button's macro="[0]!Name", and a VML shape with
x:ClientData. Notes and controls share one VML drawing per sheet; shape
ids come from 1024-id blocks listed in the drawing's idmap (after the
blocks kept header and footer drawings use), notes first, so each
control's shapeId names its VML shape.

Reading prefers the properties part, takes the caption from the VML
text box and falls back to the VML alone for files that only have it.
Values are clamped to whole numbers 0..30000 and repaired to pass the
model's rules.

Form controls of other kinds (check boxes, list boxes, drop-downs) stay
with pass-through: the reader returns the shape numbers it modelled,
and pass-through keeps the rest of the <controls> element and VML
drawing without them. On save, modelled controls join the kept
<controls> element and take a fresh shape block in the kept drawing, so
a sheet with both round-trips without duplicates. Properties part names
are reserved so kept parts of other sheets don't collide with them.

Button actions xlsx has no place for (commands, fixed inputs, output
cells) travel in a chunked hidden name keyed by sheet and position, and
are taken back out on open. The streaming sheet parser now splits only
shallow <row> elements, so an anchor's <xdr:row> inside <controls> stays
in the tree.
The Insert tab gains Button, Slider and Spin Button beside Cell
Controls › Checkbox, which is unchanged. Each arms placement: a drag on
the grid draws the control at that size (a tall drag makes a vertical
slider), a click places it at its default size, and Escape disarms. Key
tips (N B U, N S L, N S B) place one at the active cell. A new button
opens Assign Action, as Excel opens Assign Macro.

form_controls.rs draws the controls in the sheet tokens, so they look
the same in both themes: buttons with hover and pressed states, sliders
with a track, a filled part and a thumb (and the value beside the thumb
while it is dragged), spin buttons with two arrows, stacked or side by
side. A plain click works a control: dragging the thumb, clicking the
track (a page), clicking or holding an arrow (it repeats after 0.4 s),
pressing a button (it runs on release over it). A drag or a hold is one
undo step. The control last worked takes the arrows, Page Up and Page
Down, Home and End, and Space or Enter for a button. Ctrl or Cmd+click
or a right-click selects a control to move or resize it; a right-click
opens the object menu, which for a control adds Edit Text and Assign
Action (buttons) and Format Control before Delete.
Double-clicking a selected control opens its editor. On a right-to-left
sheet a control moves as a whole and works where it is drawn.

Assign Action runs a macro (from the list or typed, on the selection or
a fixed range, with an optional output cell) or a command (searched
among those a macro may run, with JSON parameters). Format Control edits
the value, limits, incremental and page change, cell link, orientation,
name and the locked and print flags, checking the same rules as the
engine. A button whose action needs approval, or whose macro would write
over data, asks in a prompt whose buttons press it again with the
answer.

New theme tokens (thumb, hover, pressed, fill, focus ring) are in the
contrast test; Button, Slider and Spin icons are drawn in code; the new
labels are translated in every interface language. The catalog gains
Developer › Controls (280 / 296).
Pressing a button whose command reads or writes a file asked "Run
file.exportCsv from 'Button 1'? It writes a file." without saying which
file, so the person could not tell what they were approving. The
question now ends with the command's `path` in parentheses; control
characters show as spaces and a path longer than 200 characters is
shortened in the middle.
The button actions xlsx has no place for (commands, fixed inputs,
output cells) are kept in a hidden name keyed by sheet and the
control's place on the sheet. When another application added, removed
or reordered controls before saving, opening the file gave the action
to whichever button now had that place, and could replace a macro the
file itself gave that button.

Each entry now also holds the button's name and anchor cell, and is
restored only on a button with that name and cell whose own action from
the file does not contradict it: a stored macro action only on a button
that still runs that macro, a stored command only on a button the file
gives no macro.
Some producers give a VML shape a named id (`id="Button 1"`) and keep
its number in `o:spid`. The form control reader looked for the number
only in `id`, so a control listed in <controls> lost its caption and
macro (they live in the VML), and a control known only from the VML was
skipped. Shapes are now matched by `id`, else by `o:spid`, as
pass-through already does when it leaves the modelled shapes out.
A sheet with more controls than a sheet keeps (10,000), properties
parts that are not XML, are missing or hold numbers no control can take
(1e400, NaN, -inf, 2^64), shape ids that are not numbers, anchors far
outside the grid, and oversized names and links. Reading keeps exactly
the cap, every control passes the model's rules, and a save and reopen
keeps them all.
Each control listed in <controls> looked for its VML shape by scanning
every shape, so a sheet of 10,000 controls took over 8 s to open. The
shapes are now indexed by number once, and the same sheet opens in
about 0.4 s.
file-format-parity.md, target-app-parity.md and ui-parity.md gave form
controls a new timestamp line without a matching revision-history row;
each now has one. The file-format-parity.md timestamp line keeps the
earlier change it replaced, as the other docs do.
control.format and control.assign refused to change a locked control on
a protected sheet, but object.move, object.delete,
object.setAnchorMode, arrange.bringForward, arrange.sendBackward and
arrange.align changed it all the same. They now refuse it with the
same message; an unlocked control still moves, and other kinds of
objects are unchanged.
The footprint counts a deleted form control as a conflict, but the
check made as each step runs counted only charts, pictures and shapes.
After a footprint that stopped early (at Solver, or an approved file
step), a later step could delete a control with no question. It now
counts controls too, so such a step stops the run under fail and asks
under ask.
The focused control took every pressed key event, the system's key
repeats included, so holding Enter or Space on a focused button ran its
macro or command again for each repeat. A repeat now still belongs to
the button (it doesn't reach the grid) but doesn't press it; arrows,
Page Up and Page Down held on a slider or spin button keep stepping.
The sheet related each control properties part with
http://schemas.microsoft.com/office/2006/relationships/ctrlProp. MS-XLSX
defines the relationship in the officeDocument namespace,
http://schemas.openxmlformats.org/officeDocument/2006/relationships/ctrlProp,
which Excel writes and looks the part up by. GridCraft's own reader
matched either (it goes by the last segment and the r:id), so its round
trips passed; Excel would not have found the parts.
The reader took the sheet's first VML drawing relationship. A sheet
with pictures in its header or footer has a second VML drawing
(<legacyDrawingHF>), and when that relationship came first the control
shapes were not found: VML-only controls were skipped, and listed
controls lost their caption and macro. The drawing is now the one
<legacyDrawing r:id> names, as pass-through already does.
The Running section says macro.check takes `output`, but the
macro.check signature further down left it out. It now lists
`output?`, and says the reported output anchor is `output` when given.
ROADMAP.md: main's header and rows kept; this branch's progress-log and revision rows re-dated 2026-11-01 on top; the Change note names both.
docs/gaps.md: main's §13 Solver rows kept; this branch's §4 row re-dated 2026-11-01 on top; the Change note names both.
docs/target-app-parity.md: main's Solver and Insert Function rows kept; this branch's chart-handles row re-dated 2026-11-01 on top; the Change note names both.
docs/ui-parity.md: main's Function Library and Esc rows kept; this branch's floating-objects row re-dated 2026-11-01 on top; the Change note names both.
Sorting and row or column edits read every anchor through
`object_anchors`, compute the new ones and write them back through
`object_anchors_mut` in step. Nothing checked that the two accessors
visit the same objects in the same order; a kind of floating object
reaching only one of them would have paired objects with other objects'
anchors silently.

Test: two objects of every kind are inserted in a mixed order, each
anchor is marked with its position through the mutable accessor, the
marks are read back through the shared one in the same sequence, the
count matches the per-kind collections, and the mark is found on the
object `object_anchor` names by kind and id. The test's constructor
matches on `ObjKind` exhaustively, so a new kind does not compile until
the test covers it.
A picture anchored to move and size with cells and spanning two rows
(or columns) was re-fitted between its top-left and bottom-right lines
after a sort. When the sort put the bottom line above the top one, the
fitted extent was negative and the picture collapsed to a zero height
or width. It now keeps its old size on that axis and travels with its
top-left line, like a "move only" picture.

Tests: for a sort by rows and one by columns, "move and size" and
"move only" pictures inside one line travel with it (the first
re-fitted to the same line, the second at its own size), an absolute
picture stays while the cells move under it, a two-line picture whose
lines swap keeps its size, and undo restores every anchor.
ROADMAP.md: both headers combined (form controls first, then main's entries); the form controls progress-log and revision rows re-dated 2026-11-01 on top of main's rows; the branch's duplicate floating-objects rows dropped in favour of main's.
docs/file-format-parity.md: header combined the same way; the form controls revision row on top of main's rows.
docs/target-app-parity.md: header combined; the form controls revision row (catalog 276 / 292 -> 280 / 296) on top of main's rows; the duplicate chart-resizing row dropped in favour of main's.
docs/ui-parity.md: header combined, its catalog count set to 280 / 296; the form controls revision row on top of main's rows; the duplicate floating-objects row dropped.
crates/ui-egui/tests/it/keytips_generated.rs: regenerated with cargo xtask keytips (370 sequences).
crates/model/src/sheet.rs: the exhaustive push_object test helper and the two-of-every-kind list gained the Control kind, which main's new test module did not know.
A button's command is refused at Insert, at Assign Action and, when a file's hidden name carries
it, at press time (file.save, file.saveAs with a path, file.open, app.commands, macro.run,
automate.runScript, control.press); nothing runs and no file is written. A slider or spin button
whose linked cell is locked on a protected sheet refuses the change through control.setValue,
Format Control and Insert, and keeps its value; a link to another sheet obeys that sheet's
protection; an unlocked linked cell takes the value.
Each listed control looked its properties part up with a scan of the sheet's relationships, so a
sheet at the 10,000-control cap compared ids a hundred million times. The relationships are
indexed by id once, as the VML shapes already were; the first of a repeated id still wins.
`Workbook::next_object_id` returned one more than the largest id in use,
saturating at `u32::MAX`. A workbook read from a file can carry an object
with that id; every later insert (a chart, picture, shape, table or
slicer) then got `u32::MAX` again, and so did each object of a copied
sheet, whose ids also came from a saturating counter. Lookups and
selection take the first object with an id, and `object.delete` removes
every one.

`Workbook::free_object_ids(count)` now returns distinct unused ids: those
above the largest in use while they last, then the lowest free ones from
1. `next_object_id` takes the first of them, and the sheet copy takes one
per copied object (and refuses if the id space were ever exhausted). The
model test that recorded the saturation now checks the free ids instead,
and a new one covers a file that used the largest ids: the free ids come
from below, 100,000 of them distinct and in order.

Test: object_ids_stay_unique_when_a_file_used_the_largest_id gives a
shape id u32::MAX, inserts two shapes and copies the sheet; every shape id
is distinct across both sheets. It fails without the fix (both new shapes
get 4294967295).
The right-click that selects the button also opens its menu at the pointer, so the plain click
that follows could have gone to the menu instead of the button. The test now closes the menu with
Escape and asserts it is closed before clicking; the dialogs test asserts that choosing a menu item
closes it.
Each listed control read and parsed its properties part again, and every read is charged to the
package's 1 GB budget, so a file whose controls all named one part spent the budget on it: the
controls after that were dropped and the parts read later (notes, threaded comments) failed with
TooLarge. The parsed part is now cached by target; a part that fails to read or isn't a
formControlPr is cached as nothing and not read again. Test: 13,000 controls naming one 200 KB
part keep the sheet's 10,000 controls and the note read after them.
crates/model/src/workbook.rs: w/objects' next_object_id over free_object_ids replaces this branch's loop; the form controls' ids join the used ids it collects, as the branch's loop had them; the branch's test that a control's id is in the sequence stays beside w/objects' tests.
crates/engine/src/cmd/sheet/tabs.rs (auto-merged): the count of free ids a copied sheet asks for includes its form controls, which the copy renumbers from the same iterator; without it the controls would all take u32::MAX.
A sheet copy renumbers its form controls from the same free ids as its charts, pictures, shapes
and slicers, so when a file's slider carries the largest id the copies still get distinct ids;
free_object_ids counts the controls' ids as used, so 3 and u32::MAX held by controls are skipped.
ROADMAP.md, docs/chart-parity.md, docs/gaps.md, docs/target-app-parity.md, docs/ui-parity.md: the header change notes combine this branch's note with main's, dated today; main's revision and progress rows stay and this branch's rows are re-dated on top. Code merged without conflict.
ROADMAP.md: both header changes (form controls first, then main's chart data tables), the form-controls progress-log and revision rows on top of main's rows.
docs/file-format-parity.md: both header changes (form controls first, then main's page order and chart data tables), the form-controls revision row on top of main's rows.
docs/macros.md: both header changes (form buttons first, then main's step-editor close rule).
docs/target-app-parity.md: both header changes (form controls and catalog 280 / 296 first, then main's ToolPak, page order and data tables), the form-controls revision row on top of main's rows.
docs/ui-parity.md: both header changes (form controls first, then main's Trace Error and page order; catalog count 280 / 296), the form-controls revision row on top of main's rows.
crates/model/src/sheet.rs: the push_object test helper (w/objects, b874f586) gets main's new Chart field, data_table: None, so the model crate's tests compile.
crates/ui-egui/tests/it/chart_data_table.rs: main's new test selects its chart through select_object_id, the one selection of w/objects, instead of the selected_chart field that w/objects replaced.
load_action_names gave every kept action back to a button the file assigned no macro. A button
that ran a macro with a fixed input range or an output cell, whose macro another application
removed while keeping the button's name and place, so came back with the assignment. Now a kept
macro action comes back only onto a button the file still assigns that macro, and a kept command
only onto a button the file assigns no macro, as the function's comment already said.

Tests: a_macro_assignment_removed_in_another_application_stays_removed (the saved file with the
controlPr macro attribute and the VML FmlaMacro removed reopens with no action and no hidden name;
unedited, with the whole action), a_macro_assigned_in_another_application_replaces_a_stored_command
(the file's macro wins over a kept command), and the cleared case in
a_kept_button_action_comes_back_only_on_the_same_button. macros.md and file-format-parity.md
describe the hidden name and the reopen rule.
Two leftovers of the merge of origin/main (25881a8e), neither a textual
conflict: `Chart` gained a `data_table` field, which the `push_object`
helper of the model's object test did not set (it is `None`, as in
`insert.chart`); and chart_data_table.rs set the `selected_chart` field
this branch replaced by `selected_object`. The test selects its chart as
a floating object, as the branch's other tests do.
`object.move` clamped `width` and `height` to 10,000 points, the most it
gives a new size, while the XLSX reader accepts anchors far past that.
A resize of a picture a file made 12,000 wide passed 11,990 through the
clamp and jumped to 10,000; `chart.set`, whose Format Chart pane sends
the unchanged dimension back with the edited one, clamped the same way.

Each dimension is now capped at 10,000 or the object's current size,
whichever is larger (`size_cap`): such an object keeps its size when it
is moved, shrinks by what a resize asks and never grows further, and a
hostile size is still capped. The params doc of `object.move` and the
control protocol notes say so.

Tests: an_oversized_imported_object_keeps_its_size_when_moved_and_shrinks_only_by_a_resize
makes a picture 12,000 by 300, writes and reads it back as a file, then
moves it without a size (12,000 stays), asks 12,010 (stays 12,000),
11,990 (11,990, no jump) and 50,000 by 50,000 (11,990 by 10,000).
chart_set_keeps_a_chart_size_a_file_made_larger_than_the_limit does the
same through `chart.set`. Both fail without the fix (width 10,000).
`drag_object` sent `width` and `height` with every step of a body drag,
so moving a picture a file made 12,000 wide shrank it to the 10,000 that
`object.move` gives a new size. Only a handle drag sends a size now; a
body move leaves the engine's size alone.

Tests (real input): dragging_the_body_of_an_oversized_imported_object_keeps_its_size
reopens the workbook with a 12,000 by 60 picture, drags its body by
30 by 25 and checks the size is untouched, the picture moved with the
pointer and the journaled `object.move` carries no width or height; it
fails without the fix (the journaled command carries both, and without
the engine's cap the picture is 10,000 wide).
a_handle_drag_on_an_oversized_imported_object_resizes_by_the_drag_only
moves the left handle 10 px right: the picture is 10 points narrower in
the window and keeps a width near 12,000, with no jump to the limit.
The Width and Height fields ranged 40 to 4,000 and sent both values on
every edit. egui clamps an existing value into a field's range, so a
chart a file made 12,000 wide showed "Width 4000", and typing a new
height sent that 4,000 as the width: the chart shrank although only its
height changed, and the cap `chart.set` keeps for an existing size
cannot help once the pane itself sends 4,000. Each field's range now
reaches the larger of 4,000 and the chart's current size, so the field
shows the real size, and a commit sends only the dimension that differs
from the chart's (`chart.set` reads `width` and `height` independently).

Test (real input): the_size_fields_keep_an_oversized_imported_chart_width_when_the_height_changes
reopens a workbook with a 12,000-wide chart, opens Format Chart Area's
Size section, checks the Width field shows 12000 and types 201 as the
height: the width stays 12,000, the height is 201 and the journaled
chart.set carries no width. Without the fix the field shows
"Width 4000".
crates/engine/src/cmd/insert.rs: the object.move params line keeps both the `control` kind (this branch) and the size-cap note (w/objects).
crates/engine/src/tests/objects.rs: both sides' new tests kept, the copied-sheet controls test first, then the two oversized-object tests.
crates/ui-egui/tests/it/chart_data_table.rs: w/objects' own fix (21a27a76, `selected_object = Some(ObjRef::new(ObjKind::Chart, id))`) replaces the equivalent select_object_id line of dcefd523.
docs/control-protocol.md: this branch's `control` kind paragraph, followed by w/objects' sentences on the object.move and chart.set size cap.
crates/model/src/sheet.rs: git merged both sides' `data_table: None` lines into the push_object Chart literal (dcefd523 and 21a27a76 made the same change at different places); the w/objects line is kept, the dcefd523 one dropped.
An entry of the hidden name without `name` or `at`, or with something other than text there,
skipped those checks (is_none_or) and could pin its action onto whatever button sat at the stored
index. The writer always stores both keys, so such an entry is now dropped like an unparsable one
(is_some_and); the doc comment says so.

Test: a_kept_action_without_the_buttons_name_or_anchor_is_dropped (an entry without `name`,
without `at`, with a number for `name` and with null for `at` gives the button no action and the
hidden name is removed; the writer's own entry still comes back).
A button's command ran through the macro policy and the file sandbox, but not through the macro
runner's request filter, so a file-borne button assigned `link.open {url}` opened the page once
the generic trust question was answered. Now `link.open` is refused for buttons up front, when it
is assigned and when a file brings it in, with the wording of the other denied commands; and
after a press runs its command, the UI requests it queued are checked as the macro runner checks
a step's: a dialog or a web page makes the press fail with the reason and rolls the group back,
a cell edit is dropped, and messages for the person stay queued.

Tests: link.open joins a_denied_command_is_refused_when_assigned_and_when_a_file_brings_it_in
(assign, insert and a file-borne press refuse it; no OpenUrl request is left), and
a_button_command_that_would_open_a_dialog_or_a_page_is_refused_after_it_runs (insert.link with no
parameters is refused with the dialog wording and its request dropped; the filter refuses a page,
drops a cell edit and keeps messages). docs/macros.md says what a button's command may not do.
A click on a button focused it, and the focus stayed while the grid moved the cell cursor with
the arrows, Tab or Delete, or opened a cell's menu with a right-click, so a later Enter or Space
pressed the button again without a new click, and Space could not start a cell edit. Now a key
press the focused button doesn't take (any key but Space, Enter and Escape, or one with Ctrl,
Cmd or Alt) gives the keyboard back to the grid, and any press that isn't a left click on the
grid, a right-click on a cell included, moves the focus off a control. A slider or spin button
keeps the keyboard as the control last worked.

Tests (kittest): a_button_gives_the_keyboard_back_when_the_grid_takes_a_key (arrow, then Enter
moves the cursor and does not press; arrow, then Space starts a cell edit; Cmd+arrow takes the
keyboard too) and a_right_click_on_a_cell_takes_the_keyboard_from_a_button. docs/ui-parity.md
says so.
The space a Space press types was dropped while any control was focused, because Space presses
a focused button. A slider or spin button doesn't take Space, so with one focused Space neither
worked the control nor started a cell edit, while every other character did. Now the space is
dropped only for a focused button; on a slider or spin button it reaches the grid like any other
character and starts a cell edit. The control keeps the keyboard, as the control last worked:
Space is a key it doesn't take, exactly like a letter, and letting go on Space alone would make
Space differ from every other printable key.

Test (kittest): space_starts_a_cell_edit_while_a_slider_or_spin_button_is_focused (a cell edit
starts with a space, the control's value is unchanged, Escape cancels, the arrows still step it).
docs/ui-parity.md says so.
With a slider or spin button focused, the Space key reached the grid and toggled a checkbox cell,
and the space it types then started a cell edit over the toggle (Escape cancelled the edit but
not the toggle). Now the typed space is dropped while a control is focused and the active cell
is a checkbox, as it is for a focused button: Space on a cell does what it does with no control
focused and nothing more, a checkbox cell toggles once with no edit, any other cell starts an
edit with a space. The path with no control focused is unchanged.

Test (kittest): space_on_a_checkbox_cell_toggles_it_once_while_a_slider_is_focused (toggled once,
no editor, the slider's value and focus unchanged; a second Space toggles back).
docs/ui-parity.md says so.
origin/main's tree is identical to 05851de4, the head of pull request 470 that a4faa909 already merged, so every conflict is the same change on both sides and this branch's side is kept:
ROADMAP.md: this branch's side (main's #470 header text and rows are already in it, with the form-controls header text and rows).
crates/engine/src/cmd/edit/paste_special.rs: this branch's side (identical #470 change, plus the control kind).
crates/engine/src/cmd/extra.rs: this branch's side (identical #470 change, plus the control commands).
crates/engine/src/cmd/extra/objects.rs: this branch's side (identical #470 change, plus the control kind).
crates/engine/src/cmd/insert.rs: this branch's side (identical #470 change, plus the control kind in object.move).
crates/engine/src/cmd/sheet/tabs.rs: this branch's side (identical #470 change, plus a copied sheet's controls).
crates/engine/src/tests/objects.rs: this branch's side (both added the file; this branch's has #470's tests and the copied-sheet controls test).
crates/model/src/features.rs: this branch's side (identical #470 change, plus the form-control types).
crates/model/src/sheet.rs: this branch's side (identical #470 change, plus the controls field and its accessors).
crates/model/src/workbook.rs: this branch's side (identical #470 change, plus the controls' ids).
crates/ui-egui/src/chartview.rs: this branch's side (identical #470 change, plus hit-testing controls).
crates/ui-egui/src/grid/cursor.rs: this branch's side (identical #470 change, plus the control cursor).
crates/ui-egui/src/grid/interact.rs: this branch's side (identical #470 change, plus the form-control interaction).
crates/ui-egui/src/objects.rs: this branch's side (both added the file; this branch's has #470's code and the control kind).
docs/control-protocol.md: this branch's side (main's size-cap sentences are already in it, with the control kind paragraph).
docs/target-app-parity.md: this branch's side (main's #470 header text and row are already in it, with the form-controls header text and row).
docs/ui-parity.md: this branch's side (main's #470 header text and row are already in it, with the form-controls header text and row).
ROADMAP.md: header combined (this branch's form-controls note first, then main's Solver Sensitivity report note; Last updated 2026-11-02); the form-controls progress-log and revision rows stay above main's Solver Sensitivity rows.
docs/target-app-parity.md: header combined (this branch's form-controls note first, then main's Solver Sensitivity report note); the form-controls revision row stays above main's Solver Sensitivity row.
A click on a form control that form_controls::interact leaves to the grid (Ctrl or Cmd+click,
which selects the control; a click on a selected control, which moves it) fell through to the
slicer tile branch, which looks only at slicers, so a control placed over a slicer's value tile
had the tile toggled and the slicer selected before the generic object handling could select or
drag the control. The slicer tile branch now runs only when the press lands on a slicer by the
same test the generic path uses (the selected object's handle first, then the topmost object), so
the z-order decides once; a control over a tile, and a selected object's handle over one, keep
the generic path. Charts, pictures and shapes lie beneath slicers in that order, so they were not
affected.

Test (kittest): a_control_over_a_slicer_tile_keeps_the_generic_path_on_a_selecting_click (a button
over the first tile; Cmd+click selects the button and the slicer's filter is unchanged; a click
on the selected button still toggles nothing; an uncovered tile still toggles).
write_link skipped the write only when the linked cell held a constant equal to the value; a cell
with a formula was always written, so Format Control's OK (which sends the value back every
time) replaced the formula with a constant even when the formula showed that value, and on a
protected sheet with the linked cell locked a rename was refused. The value the cell shows is now
compared whether or not it holds a formula: a write that changes nothing is skipped, and a real
change still replaces the formula with the constant, as in Excel.

Test: a_formula_in_the_linked_cell_survives_a_write_of_the_value_it_shows (insert and Format
Control with the value the formula shows keep the formula, also on a protected sheet with the
cell locked; a changed value writes the constant).
without_controls found the controls to drop from a kept <controls> fragment by splitting its
text on `shapeId="`. The control reader takes the attribute through the XML parser, which also
accepts `shapeId='1025'`, so a producer's single-quoted control was modelled, its VML shape taken
out of the kept drawing, and the control itself still kept: a save wrote it twice, the kept copy
pointing at a shape that no longer existed. The kept child is now parsed and its controls found
with the reader's own helpers (controls_of_child, shape_number), so what the reader modelled is
what is dropped. The shape type check of the VML merge (`<v:shapetype id>`) accepts either
quote style too, so a kept drawing that defines our shape type with single quotes is not given
a second definition.

Test: a_single_quoted_shape_id_is_dropped_from_the_kept_controls_too (the control is read once,
nothing of it is kept, the saved sheet holds one control and no single-quoted copy, the VML one
shape, and the file reads back with one control).
without_controls dropped a whole child of a kept <controls> element as soon as one control in it
was modelled, so an mc:AlternateContent holding a scroll bar (modelled) and a list box (left to
pass-through) lost the list box's worksheet entry on save, while its VML shape and properties
part stayed. The controls are now taken out one by one, in the Choice and the Fallback branches
alike, by the shapeId the control reader reads (an attribute, in either quote style); the wrapper
stays while a control remains and goes only when it is empty, and a child with none of ours is
kept unchanged. strip_shapes already works per shape, so the kept control's shape stays, and its
properties part follows its relationship as before.

Test: an_unsupported_control_beside_a_modelled_one_in_one_alternate_content_is_kept (after open
and save the scroll bar is written once, the list box is still in <controls> in both branches
with its VML shape and its properties part, and the file reads back with one modelled control and
the kept one).
Both sides added a kind of floating object (equation, form control); both are kept everywhere.
ROADMAP.md: header combined (form controls first, then equations), catalog 281 / 296 as `cargo xtask parity` measures, the form-controls progress-log and revision rows above main's equation rows.
crates/engine/src/cmd.rs: both spec lists (controls and equation).
crates/engine/src/cmd/extra.rs: the arrange params docs list both kinds.
crates/engine/src/cmd/extra/objects.rs: main's `found` match and `anchors_of` on ObjKind gain the Control arms; the unlocked check takes the parsed kind directly.
crates/engine/src/cmd/insert.rs: the object params docs and the kind error name both kinds.
crates/engine/src/tests.rs: both test modules.
crates/engine/src/tests/objects.rs: every_kind returns six objects (equation at L18, slider at P18) and the anchor lists carry both.
crates/model/src/features.rs: ObjKind has Equation and Control, ALL lists six kinds, name() both.
crates/model/src/sheet.rs: both imports, both accessor arms, the order test inserts equations (6, 8) and controls (13, 15) and documents controls after slicers with equations counted as shapes.
crates/model/src/workbook.rs: main's refresh_equations and this branch's free-id doc comment.
crates/ui-egui/src/chartview.rs: both doc comments combined.
crates/ui-egui/src/objects.rs: both OpenAction variants and arms.
crates/ui-egui/src/ribbon/insert.rs: the import list is the union.
docs/control-protocol.md: the kind list names equation and control; main's equation sentences and this branch's form-controls sentence.
docs/file-format-parity.md: header combined; the xlsx row carries both additions; the form-controls revision row above main's equation rows.
docs/parity-checklist.md: regenerated with `cargo xtask parity` (281 / 296).
docs/target-app-parity.md: header combined; catalog 281 / 296; the Insert objects row carries both additions; the form-controls revision row (277 / 292 → 281 / 296) above main's.
docs/ui-parity.md: header combined with catalog 281 / 296; main's move-and-resize row with equations plus the form-controls row; the form-controls revision row above main's.
ROADMAP.md: header combined (form controls first, then main's Python mode and Python cells notes); the form-controls progress-log and revision rows above main's Python rows.
crates/engine/src/io.rs: open_plain's doc comment names both (the button actions kept in hidden names, and the adopted Python cells); after the macros it loads the button actions, then adopts the Python cells and enforces their limits.
crates/ui-egui/src/theme.rs: this branch's sheet control colours and main's PY tag colour.
docs/file-format-parity.md: header combined (form controls first, then main's Python cells note); the form-controls revision row above main's Python row.
docs/ui-parity.md: header combined (form controls first, then main's Python mode note; ribbon catalog count 281 / 296); the form-controls revision row above main's Python row.
A button could be given a fixed input range for any macro name; pressing it then passed the range
to macro.run as `inputs`, which check_params refuses for a macro without inputs ("it takes no
inputs"), so such a button failed on every press. Now insert.button and control.assign refuse a
fixed input when the named macro exists and declares no inputs, naming the macro; a macro the
workbook does not have yet is not checked, and the assignment is kept as given. On open, a stored
fixed input for a macro without inputs becomes the selection: the file itself assigns the macro
on the selection, and the stored range would fail every press.

Tests: a_fixed_input_for_a_macro_without_inputs_is_refused_when_assigned (insert and assign are
refused with the reason in any letter case; a macro with an input and a macro not yet defined
take the range; a stored fixed input comes back as the selection). format_and_assign and
a_kept_button_action_comes_back_only_on_the_same_button give their macro an input.
The pass-through writer found the kept element's end by the literal `</controls>`, so a producer
that prefixes the main namespace (`</x:controls>`) got a second <controls> element for the
modelled controls, which the worksheet schema does not allow. The close tag is now found by its
local name with any prefix. No other literal tag search is left in rebase.rs; the ones in read.rs
(VML `<o:idmap>`, `<v:shapetype>`, `ObjectType="Note"`) rely on the fixed VML prefixes and are
main's code.

Test: a_modelled_control_joins_a_kept_controls_element_with_a_namespace_prefix (a kept
`<x:controls>` with a list box and a modelled slider save as one controls element holding both,
and the file reads back with the slider modelled and the list box kept).
The pass-through writer put GridCraft's control entries before the last <controls> close tag of
the kept fragment, so a kept mc:AlternateContent with separate <controls> elements in its Choice
and Fallback got them in the Fallback, which the reader (and an application that knows x14)
doesn't read: on reopen the control came back from its VML shape alone, without its name and
its properties part. The entries now go into the <controls> element the reader reads: the
Choice's when the Choice holds one, else the first one (a plain fragment, or a Fallback alone);
a Fallback's element is left as the file had it. Tags are matched by local name, with any
namespace prefix.

Test: a_modelled_control_joins_the_choice_controls_element_of_a_kept_alternate_content (the saved
Choice element holds the kept list box and the modelled slider, the Fallback only the list box;
the file reads back with the slider's name, link and value from its worksheet entry and
properties part, and the list box kept).
A ui.key Enter or ui.click on OK reached egui as ordinary input and
could confirm the openLink prompt. A pass that carries synthetic input
now keeps the prompt open and opens nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Upstream folded cmd/insert/*.rs back into insert.rs, so the merge left
the policy check in a file that is no longer compiled. Restore that file
to upstream and apply the check in the live open_link.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Conflicts:
- crates/xlsx/src/read.rs: main's names.unique() kept with this branch's
  (sheet, read_controls) result from read_sheet.
- crates/ui-egui/tests/it/keytips_generated.rs: regenerated with
  cargo xtask keytips from the merged keytips.json (413 sequences).
- docs/file-format-parity.md, docs/ui-parity.md: header and revision
  history keep main's entries and this branch's form-controls entries.
XLSX: the XML element cap counts only elements kept in the tree
link: require confirmation for programmatic link.open (#2181)
Form controls: buttons, sliders and spin buttons, with Assign Action, Format Control and XLSX round trip
* About: credits tables fit without side-scrolling and their columns resize

The Contributors table and the Models table were egui Grids inside a
two-way scroll area: they opened wider than the dialog, so they scrolled
sideways, and Company and Model sat almost touching. Both are now
egui_extras tables. Each column opens at the width of its header and widest
cell, the spare width goes to the text columns (Name; Company and Model),
and every column edge can be dragged. Widening a column grows the table
like a spreadsheet, and only then does it scroll sideways; the header stays
put while the rows scroll. Counts and dates are right-aligned and every
cell is vertically centred.

The sorted column stays highlighted and its direction shows on the
toolbar's sort-order button, so headers no longer reserve room for an
arrow. The opening widths come from fit_widths, a pure function with unit
tests that a fitted table fills its room exactly and that only the text
columns give way when room is short.

The About dialog opens 820 points wide, so every column fits at its natural width.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Let every credits column be dragged, and refit changed tables

The last column was egui's remainder column, which has no drag handle, so
it could only be resized from the edge before it. It is now an ordinary
column with its own handle.

A table keeps its column widths, so switching to a longer name left the
Name column at its old width and clipped the text. The table now goes
back to the opening fit whenever that fit changes: a longer widest cell
or a resized window. Dragged widths are dropped at that point.

fit_widths could overflow the room when one column hit the minimum,
because the other columns did not take up its share. Columns now give
way in proportion to their width above the minimum.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Refit credits tables on what they measure, not the fitted widths

Comparing the fitted widths missed the case it was meant for. Name is the
only growing column, so a longer name takes its extra width from the
spare room and the fit comes out the same: a dragged Name width stayed,
clipping the longer name.

It could also drop dragged widths by accident. The fit comes from the
available width inside the scroll area, which scrolling can nudge, so
scrolling a widened table could reset it.

The table now compares the natural widths and the clip rect's width,
which scrolling does not move.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Charts: draw every doughnut series as a ring (#1827)

* Charts: submit doughnut hole size and first slice angle when the drag ends (#1827)

---------

Co-authored-by: alosslessdev <alosslessdev@users.noreply.github.com>
German showed "Einfügen" for Paste and again for Insert in the cell menu
("Einfügen…") and the row and column header menus ("Einfügen"). The cell
menu's Insert… now reads "Zellen einfügen…", as Excel's German menu does.
The header menus' Insert gets its own key, "Header Menu|Insert", German
"Zellen einfügen"; the plain "Insert" stays as the Insert dialog's title
and button use it, and every other catalog gets the new key with the text
it shows today.

A test reads the three menus' items from menus.rs and checks that no two
read alike in German.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
data-host="page" on the canvas opts a page that loads the module into its own document into the host bridge. The ?host=parent messages travel as non-bubbling CustomEvents on the canvas; Bridge holds a Transport (Parent or Page) and shares the save, dirty and ready logic. Unframed ?host=parent still gets no bridge. Hosting guide documents both modes.
The transports, the message types and the origin checks come from the shared crate (storytold/craft-libs#420); GridCraft keeps the download hook, the open size limit, the workbook-saved rule and the author.
* UI: a dialog's reference boxes belong to the sheet it was opened on, recorded when it opens rather than at the first pick

* UI: a click on the cell already selected writes it into the reference box being picked into

* Solver: references split into areas only at commas outside quoted sheet names, through one splitter shared with the reference boxes

* Solver: a constraint splits at its relation only outside quoted sheet names, in constraint text and in a model loaded from cells

* Solver: Save Model counts a constraint's areas outside quoted sheet names, and reads a number on the right side as one value whatever its separators

* UI: a Ctrl+click that follows a link is no pick of the cell already selected

The press on the grid tells the reference box being picked into that a
cell was selected only in the branches that select: Shift+click, Ctrl+click
that adds a cell, and a plain click. A Ctrl+click on a link's text follows
the link and selects nothing, so a link back to the selected cell no longer
replaces the box's text.

* UI: while a reference box picks, a second quick click on a cell picks it

A click on the same cell within the double-click interval started editing
the cell and skipped the pick, also when the earlier click came before the
box was clicked into. While a reference box is the one grid selections
fill, the double-click handling is skipped and the click picks.

* Docs: reference boxes take a second quick click as a pick; a followed link is none

* UI: while a reference box picks, a click on a link or checkbox picks its cell

A link was followed (Go To moved the selection into the box, and a web
link's question replaced the dialog) and a checkbox was toggled. While a
reference box is the one grid selections fill, a click only picks the cell
clicked, with or without Ctrl. The test of the Ctrl+click on a link back to
the selected cell becomes part of a test of links on the same sheet, a web
link and a checkbox.
Web: page host mode, so a page can host GridCraft in its own document (#2592)
i18n: German context menus' Insert reads "Zellen einfügen", not a second "Einfügen" (#2874)
* ft-121.7.9: apply Set precision as displayed in calculation (#1343)

With the option on, a formula result (and each element of a spill) is
rounded to its cell's number format before it is stored and before other
formulas read it. Numbers typed, pasted or reformatted while it is on are
rounded at once, and turning it on through formulas.calculationOptions
{precisionAsDisplayed} rounds every number constant, as Excel does.

The rounding is NumberFormat::round_as_displayed in the numfmt crate,
which shares the renderer's digit logic (fixed, scientific, fraction).
General, date/time, text, digitless and conditional formats keep the full
value, as observed in Excel through COM. Nothing changes when the flag is
off.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ft-121.7.9: round conditional formats by the sign's section under precision as displayed (#1343)

Excel does round formats with a condition when "Set precision as
displayed" is on; the PR kept them at full value. Observed through COM
with synthetic values (and in gridcraft-corpus
excel/precision-displayed/pad-on-conditional-sections.xlsx): conditions
are ignored and the sign picks the section, the first for positives and
the second for negatives. `[<1]0.00;0` shows 2+1/3 as 2 but stores 2.33,
and stores -10/3 as -3.

Two more observed details: with a condition and a single number section,
negatives keep the full value (`[<1]0.00`), unless an `@` section follows
(`[<1]0.00;@` rounds them by the first section); and a completely empty
section passes to the next one (`0.0;;0.000` stores -2.333 as -2.333,
`;0.0` stores 2.333 as 2.3), for formats with or without a condition.

Display is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* engine: recalculate spill anchors when a spill cell is reformatted under precision as displayed

round_edited_as_displayed only looked at stored-cell changes, but a spill
destination lives in Sheet::spill, so reformatting it (or its row or column) left
the anchor out of the changed set and the element unrounded. Add each spill anchor
whose range holds a changed cell or a changed row/column style to the changed set.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* numfmt: drop a cast the fraction merge made redundant

* precision as displayed: keep locked constants on protected sheets, round new sheets, fix manual-mode comment

* precision as displayed: name the input sheet in the new-sheet histogram test

* precision as displayed: use six values in the new-sheet histogram test

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Paste of a whole-column or whole-row copy no longer aborts the app (#2018)
Some checks failed
ci.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (pull_request) Failing after 0s
Details
nix.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (pull_request) Failing after 0s
Details
packaging-lint.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (pull_request) Failing after 0s
Details
sonarcloud.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (pull_request) Failing after 0s
Details
ci.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (push) Failing after 0s
Details
nix.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (push) Failing after 0s
Details
packaging-lint.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (push) Failing after 0s
Details
sonarcloud.yml / Paste of a whole-column or whole-row copy no longer aborts the app (#2018) (push) Failing after 0s
Details
21b64df0fe
 
* Paste: whole-column paste and validation without per-cell blowup

edit.paste of a whole-column or whole-row copy walked every cell of the
copied block (up to the whole sheet) and, for each one, re-cut every
validation rule and pushed a one-cell rule. Over a 2M-cell block that is
quadratic and the fuzz soak aborted on 34-68 GB allocations.

- Paste visits only cells that hold something in the source or the
  destination; blank onto blank changes nothing (and with an operation
  stays blank, as in Excel, instead of becoming 0).
- Validation pastes as ranges: the pasted rectangle is cut once out of
  the destination's rules and each source rule comes along as one rule
  over its translated parts (Skip Blanks or not, as Excel does).
- Whole columns and rows paste whole, so destination content further
  down the columns is replaced, as in Excel.
- A paste that does not fit on the sheet is refused, as Excel does,
  instead of pasting part of the block (whole columns below row 1, whole
  rows right of column A, a whole column transposed, a block at XFD).
- Paste Link, the one paste that writes every cell, is capped at
  1,048,576 cells; tiled validation at 100,000 ranges.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Paste: visit destination cells once per paste, add link, transpose and tiling tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Paste: visit link-only cells so a cut keeps their hyperlink

* Paste validation: Skip Blanks keeps the destination rule under a blank source cell with no rule

* Paste validation: Skip Blanks collects clearing cuts only when a rule is under the paste, merges them into runs, and limits only generated areas

* Paste validation: annotate the clearing cut list

* Qualify paste validation context type

* Fix paste-special clippy warnings

* engine: batch validation range cuts

* Fix range type inference

* Annotate validation range index type

* Avoid shadowing test session helper

* Keep validation rows after the final cut

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
alf merged commit 21b64df0fe into main 2026-11-05 22:04:50 +00:00
alf deleted branch chore/sync-upstream-20261105 2026-11-05 22:04:50 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
  
herkunft/alpha-feedback
Aus Rückmeldungen der Alpha-Tester

  
status
blockiert
 Wartet auf etwas anderes

  
status
zu-testen
 Gebaut, aber noch nicht im echten Einsatz geprüft

  
typ
bug
 Fehler

  
typ
docs
 Dokumentation

  
typ
enhancement
 Verbesserung einer vorhandenen Funktion

  
typ
feature
 Neue Funktion

  
typ
idea
 Idee, noch nicht entschieden

No labels
herkunft/alpha-feedback
status
blockiert
status
zu-testen
typ
bug
typ
docs
typ
enhancement
typ
feature
typ
idea
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
iris/gridcraft!17
No description provided.