diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index 20ee6e9a..88ae21b9 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -98,7 +98,9 @@
       "Bash(git push *)",
       "Bash(rustup show *)",
       "Bash(echo \"exit: $?\")",
-      "Bash(claude plugin *)"
+      "Bash(claude plugin *)",
+      "Bash(cp \"/root/.claude/uploads/995af0a3-e865-5b96-b002-e90985880970/cc51b77a-spec01codebaseauditandarchitecture.md\" \"/home/user/loki/docs/adr/spec-01-codebase-audit-and-architecture.md\" && echo \"placed\" && ls -la docs/adr/spec-01-codebase-audit-and-architecture.md)",
+      "mcp__code-review-graph__list_graph_stats_tool"
     ]
   },
   "enableAllProjectMcpServers": true,
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index ce7030e8..bb359a7e 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -21,10 +21,35 @@ jobs:
       with:
         components: rustfmt, clippy
     - uses: Swatinem/rust-cache@v2
+    - name: License-header gate (per-crate SPDX on line 1)
+      # loki-opc is MIT (released standalone); the rest of the suite is
+      # Apache-2.0. See docs/adr/0010-per-crate-licensing.md.
+      run: python3 scripts/check-license-headers.py
+    - name: Panic-guard gate (no panic!/todo!/unimplemented! in lib src)
+      # Spec 01 audit A-6. unreachable! with a message is permitted.
+      run: python3 scripts/check-no-panics.py
+    - name: Unsafe-policy gate (forbid, or deny + allow-list)
+      # Spec 01 audit A-7. Only the 3 Android cdylib crates may use deny+allow.
+      run: python3 scripts/check-unsafe-policy.py
+    - name: File-ceiling gate (300-line ratchet)
+      # Spec 01 audit A-2. New files <= 300 lines; baselined debt may not grow.
+      run: python3 scripts/check-file-ceiling.py
+    - name: TODO-format gate (TODO(<topic>) tags)
+      # Spec 01 audit A-11. No bare TODO / FIXME / HACK / XXX in production code.
+      run: python3 scripts/check-todo-format.py
+    - name: Dependency-direction gate (acyclic, downhill-only)
+      # Spec 01 audit A-13 / ADR-0009. Fails on any uphill internal edge.
+      run: python3 scripts/check-dependency-direction.py
+    - name: Viewport-dimension guard (no assumed screen sizes)
+      # Spec 01 audit A-1. No bare 1280-class literals in editor input/viewport paths.
+      run: python3 scripts/check-no-hardcoded-viewport-dims.py
     - name: Format check
       run: cargo fmt --all --check
     - name: Clippy (workspace, all features, warnings denied)
-      run: cargo clippy --workspace --all-features -- -D warnings
+      # `unwrap_used`/`expect_used` keep panicking calls out of library runtime
+      # code (audit A-5); clippy.toml exempts test code. Tooling (build.rs, the
+      # gen_templates bin) carries a scoped file-level allow.
+      run: cargo clippy --workspace --all-features -- -D warnings -D clippy::unwrap_used -D clippy::expect_used
 
   build-and-test:
     runs-on: ubuntu-latest
@@ -33,6 +58,11 @@ jobs:
     - name: Install toolchain
       uses: dtolnay/rust-toolchain@stable
     - uses: Swatinem/rust-cache@v2
+    - name: Install xmllint (libxml2)
+      # appthere-conformance's schema axis (Spec 02 M2) shells to xmllint; install
+      # it so those tests actually run instead of skipping. The harness fails
+      # loudly if it is absent, so this keeps the schema axis genuinely exercised.
+      run: sudo apt-get update && sudo apt-get install -y libxml2-utils
     # `--all-features` so the feature-gated format crates (pptx, xlsx) and their
     # integration tests actually compile and run — under the default feature set
     # `cargo test --workspace` silently skips `#![cfg(feature = ...)]` suites.
diff --git a/.gitignore b/.gitignore
index d27a9726..6a7fc2df 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,3 +29,19 @@ loki-opc/.DS_Store
 
 # cargo vendor output — dependencies are patched via patches/ not vendored
 vendor/
+
+# Stray debug/render dumps at the repo root (Spec 01 audit A-4). These are
+# generated by examples/benches (e.g. `render_to_png` writes ./output.png) and
+# must not be committed — keep them ignored so they can't drift back in.
+/scratch.rs
+/diff_flow.txt
+/output.png
+/iris*.png
+/iris*.log
+/test_output*.png
+/test_output*.txt
+/test_log*.txt
+
+# Python bytecode cache (from scripts/*.py gate helpers)
+__pycache__/
+*.pyc
diff --git a/CLAUDE.md b/CLAUDE.md
index 1c4cade6..85139075 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -82,10 +82,21 @@ These conventions apply to all crates in the workspace.
 - **Error handling:** Use typed error enums with `thiserror`. Do not use `anyhow`
   in library crates. Do not use `.unwrap()` or `.expect()` in library code
   outside of `#[cfg(test)]` blocks.
-- **Unsafe:** `#![forbid(unsafe_code)]` must be present in `lib.rs` for all
-  `appthere-ui` and future library crates.
-- **License header:** Every `.rs` file must begin with:
-  `// SPDX-License-Identifier: Apache-2.0`
+- **Unsafe:** every crate root must carry `#![forbid(unsafe_code)]`. The sole
+  exception is the three Android `cdylib` binaries (`loki-text`,
+  `loki-presentation`, `loki-spreadsheet`): their `#[unsafe(no_mangle)]`
+  `android_main` FFI entry point makes `forbid` impossible, so they use
+  `#![deny(unsafe_code)]` + a scoped `#[allow(unsafe_code)]` (emitted by
+  `loki_app_shell::android_main!`) and are enumerated in
+  `scripts/unsafe-policy-allowlist.txt`. Enforced in CI by
+  `scripts/check-unsafe-policy.py` (Spec 01 audit A-7). New crates must `forbid`.
+- **License header:** Line 1 of every `.rs` file must be the SPDX identifier
+  matching that crate's `Cargo.toml` `license` field, line 2 the copyright.
+  The suite is Apache-2.0 (`// SPDX-License-Identifier: Apache-2.0`), **except
+  `loki-opc`, which is MIT** (`// SPDX-License-Identifier: MIT`) because it is
+  released as a standalone crate — see
+  [docs/adr/0010-per-crate-licensing.md](docs/adr/0010-per-crate-licensing.md).
+  Enforced in CI by `scripts/check-license-headers.py`.
 - **Annotations:**
   - `// COMPAT(dioxus-native): <explanation>` — marks any workaround for a
     Dioxus Native / Blitz CSS or API limitation, including unconfirmed CSS
@@ -132,13 +143,21 @@ lines). The full list and a proposed split strategy live in
 offenders are below. This is a dedicated split-pass backlog, not a per-change
 blocker — but do not *grow* these files or add new ones over the ceiling.
 
-The split pass is **in progress** — **11 of 43 files done** (≈32 remain). Two
-techniques:
+**The ceiling is now mechanically enforced** (Spec 01 audit A-2):
+`scripts/check-file-ceiling.py` (CI) ratchets against
+`scripts/file-ceiling-baseline.txt` — new files must be ≤300, baselined files
+may not grow, and a file split to ≤300 must be removed from the baseline. So the
+backlog can only shrink. When you split a file below the ceiling, drop its line
+with `scripts/check-file-ceiling.py --update` (review the diff).
+
+The split pass is **in progress** — current backlog is the **35** entries in the
+baseline file. Two techniques:
 1. *Inline-test extraction* (safest, no production-code change): move a file's
    `#[cfg(test)] mod tests { … }` into a sibling `<name>_tests.rs` referenced via
    `#[cfg(test)] #[path = "<name>_tests.rs"] mod tests;`. Done 2026-06-21 for
    `block.rs`, `docx/mapper/{paragraph,numbering,mod,table}.rs`, `odt/import.rs`,
-   `odt/mapper/lists.rs`, `layout/result.rs`, `renderer/render_layout.rs` — each
+   `odt/mapper/lists.rs`, `layout/result.rs`, `renderer/render_layout.rs`, and
+   2026-06-28 for `editing/hit_test.rs`, `xml_util.rs`, `pdf/src/page.rs` — each
    was over the ceiling only because of a large inline test module.
 2. *Directory split*: convert `foo.rs` → a `foo/` directory with section-cohesive
    submodules, re-export the public entry points from `foo/mod.rs`, and move the
@@ -153,15 +172,18 @@ techniques:
 
 | File | Current lines | Priority |
 |---|---|---|
-| `loki-layout/src/flow.rs` | 1612 | High |
-| `loki-odf/src/odt/reader/styles.rs` | 1441 | High |
-| `loki-odf/src/odt/reader/document.rs` | 1428 | High |
-| `loki-layout/src/para.rs` | 1278 | High |
-| `loki-spreadsheet/src/routes/editor/editor_inner.rs` | 1241 | High |
-| `loki-ooxml/src/docx/write/document.rs` | 1169 | High |
-| `loki-ooxml/src/docx/reader/document.rs` | 1126 | High |
-| `loki-text/src/routes/editor/editor_inner.rs` | 1040 | High |
-| … 24 more (300–600 lines) — see the audit (10 files split 2026-06-21) | | |
+| `loki-layout/src/para.rs` | 1979 | High |
+| `loki-layout/src/flow.rs` | 1953 | High |
+| `loki-odf/src/odt/reader/styles.rs` | 1554 | High |
+| `loki-odf/src/odt/reader/document.rs` | 1494 | High |
+| `loki-spreadsheet/src/routes/editor/editor_inner.rs` | 1244 | High |
+| `loki-ooxml/src/docx/reader/document.rs` | 1209 | High |
+| `loki-ooxml/src/docx/write/document.rs` | 1073 | High |
+| `loki-layout/src/resolve.rs` | 984 | High |
+| … 27 more (6 over 600, 21 in 300–600) — see `scripts/file-ceiling-baseline.txt` | | |
+
+*(Sizes above are from `scripts/file-ceiling-baseline.txt`, refreshed 2026-07-04;
+the earlier numbers were stale — several files grew since first baselined.)*
 
 (`odt/mapper/document.rs` (1094 lines) was split into the `odt/mapper/document/`
 directory on 2026-06-26 — each module is now under the ceiling.)
@@ -179,7 +201,7 @@ but are **not perfectly round-tripped through the Loro CRDT**.
 |---|---|---|
 | `tab_stops` | Written as unreadable Debug string; not read back. | Medium |
 | `background_color` (paragraph) | Written as Debug string; not decoded on read. | Low |
-| `DocumentMeta` / `DublinCoreMeta` | Round-trips **through the Loro CRDT** as a JSON snapshot (`loro_bridge::meta`), so Publish-tab edits are durable and undoable. Still **not** written back to DOCX/ODT on export (export drops the extended Dublin Core fields). | Low |
+| `DocumentMeta` / `DublinCoreMeta` | Round-trips **through the Loro CRDT** (`loro_bridge::meta`) **and is written back on export** — core properties + extended Dublin Core reach DOCX (`docProps/core.xml` + `custom.xml`) and ODT (`meta.xml`), tested by `metadata_round_trip.rs` / `extended_dublin_core_round_trips`. Remaining tail (not the Loro bridge): custom user properties, `meta:editing-duration`, and OOXML `docProps/app.xml` are still not written. | Low |
 
 ---
 
@@ -318,6 +340,18 @@ is documented in the Loki Text UI specification (v0.4).
 5. All interactive elements: 44×44 px minimum, documented in a doc comment.
 6. Mark Dioxus Native CSS limitations with `// COMPAT(dioxus-native): ...`
 
+### Conditionally-mounted panels are components (ADR-0013)
+
+A panel shown behind a condition must be a `#[component]` mounted **at the
+boundary** — `{open().then(|| rsx! { Panel { .. } })}` — never a plain function
+called inside `if cond { panel(..) }` with an early `return rsx!{}`. Only a
+component owns a hook scope, so only a component can call `use_breakpoint()` (or
+any hook) and adapt to the size class **without threading a `compact` flag**
+through the parent (which grows it). Prefer hosting the panel in
+`appthere_ui::AtPanelHost`, which reads the breakpoint and picks Compact-sheet vs
+Expanded-side-panel posture for you. See
+[docs/adr/0013-conditional-panels-are-components.md](docs/adr/0013-conditional-panels-are-components.md).
+
 ### Confirmed CSS properties (Dioxus Native 0.7.x / Blitz)
 
 These work in production code:
diff --git a/Cargo.lock b/Cargo.lock
index 5c7fa3c5..f9238383 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -110,6 +110,15 @@ dependencies = [
  "winit",
 ]
 
+[[package]]
+name = "addr2line"
+version = "0.25.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5d307320b3181d6d7954e663bd7c774a838b8220fe0593c86d9fb09f498b4b"
+dependencies = [
+ "gimli",
+]
+
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -265,7 +274,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -276,14 +285,14 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "anyrender"
@@ -319,7 +328,7 @@ dependencies = [
  "kurbo 0.12.0",
  "peniko",
  "pollster",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "vello",
  "wgpu",
  "wgpu_context",
@@ -384,6 +393,16 @@ dependencies = [
  "thiserror 2.0.18",
 ]
 
+[[package]]
+name = "appthere-conformance"
+version = "0.1.0"
+dependencies = [
+ "loki-doc-model",
+ "loki-sheet-model",
+ "tempfile",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "appthere-ui"
 version = "0.1.0"
@@ -438,9 +457,9 @@ checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
 
 [[package]]
 name = "arrayvec"
-version = "0.7.7"
+version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02882884d3e1bc524fb12c79f107f6ad0e1cfd498c536ffb494301740995dfe"
+checksum = "d3fb67a6e08acf24fdeccbac2cb6ac4305825bd1f117462e0e6f2f193345ad56"
 
 [[package]]
 name = "arref"
@@ -815,6 +834,21 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "backtrace"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb531853791a215d7c62a30daf0dde835f381ab5de4589cfe7c649d2cbe92bd6"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-link",
+]
+
 [[package]]
 name = "base16"
 version = "0.2.1"
@@ -1838,6 +1872,22 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "dhat"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98cd11d84628e233de0ce467de10b8633f4ddaecafadefc86e13b84b8739b827"
+dependencies = [
+ "backtrace",
+ "lazy_static",
+ "mintex",
+ "parking_lot",
+ "rustc-hash 1.1.0",
+ "serde",
+ "serde_json",
+ "thousands",
+]
+
 [[package]]
 name = "diff"
 version = "0.1.13"
@@ -1940,7 +1990,7 @@ dependencies = [
  "futures-util",
  "generational-box",
  "longest-increasing-subsequence",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "rustversion",
  "serde",
  "slab",
@@ -2086,7 +2136,7 @@ checksum = "11999d6eb5bb179a9512dad30e5de408aab66f2cb65de9098c9fbe02927e2978"
 dependencies = [
  "js-sys",
  "lazy-js-bundle",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "sledgehammer_bindgen",
  "sledgehammer_utils",
  "wasm-bindgen",
@@ -2131,7 +2181,7 @@ dependencies = [
  "futures-util",
  "keyboard-types",
  "log",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "tokio",
  "webbrowser",
  "winit",
@@ -2147,7 +2197,7 @@ dependencies = [
  "dioxus-html",
  "futures-util",
  "keyboard-types",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
 ]
 
 [[package]]
@@ -2209,7 +2259,7 @@ dependencies = [
  "futures-util",
  "generational-box",
  "parking_lot",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "tracing",
  "warnings",
 ]
@@ -2259,7 +2309,7 @@ dependencies = [
  "gloo-timers",
  "js-sys",
  "lazy-js-bundle",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "send_wrapper",
  "serde",
  "serde-wasm-bindgen",
@@ -2748,7 +2798,7 @@ dependencies = [
  "fluent-syntax",
  "intl-memoizer",
  "intl_pluralrules",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "self_cell",
  "smallvec",
  "unic-langid",
@@ -2822,9 +2872,9 @@ dependencies = [
 
 [[package]]
 name = "font-types"
-version = "0.12.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81bf886368962a7d8456f136073ed33ed1b0770c690d2063731bb6a776e99f33"
+checksum = "ad67eced03f5504d9cbd3a879b5958b5c54d4e5fd794361c6eb21b05fb703411"
 dependencies = [
  "bytemuck",
 ]
@@ -3101,7 +3151,7 @@ dependencies = [
  "itertools 0.11.0",
  "loro-thunderdome",
  "proc-macro2",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
 ]
 
 [[package]]
@@ -3162,6 +3212,12 @@ dependencies = [
  "weezl",
 ]
 
+[[package]]
+name = "gimli"
+version = "0.32.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
+
 [[package]]
 name = "gl_generator"
 version = "0.14.0"
@@ -3208,9 +3264,9 @@ dependencies = [
 
 [[package]]
 name = "gpu-alloc"
-version = "0.6.0"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbcd2dba93594b227a1f57ee09b8b9da8892c34d55aa332e034a228d0fe6a171"
+checksum = "45cf04b2726f02df5508c6de726acdc90cdf97ac771a9a0ffd8ba10a6e696bf9"
 dependencies = [
  "bitflags 2.13.0",
  "gpu-alloc-types",
@@ -3218,9 +3274,9 @@ dependencies = [
 
 [[package]]
 name = "gpu-alloc-types"
-version = "0.3.0"
+version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98ff03b468aa837d70984d55f5d3f846f6ec31fe34bbb97c4f85219caeee1ca4"
+checksum = "b2bbed164dd10ed526c2e4fe3e721ca4a71c61730e5aafac6844b417b3227058"
 dependencies = [
  "bitflags 2.13.0",
 ]
@@ -3540,9 +3596,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.3.0"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
+checksum = "15cdd26707701c53297e2fa6afb323d55fbc1d0810c3aec078ae3ef0424c3c15"
 
 [[package]]
 name = "hyper"
@@ -4078,9 +4134,9 @@ checksum = "00810f1d8b74be64b13dbf3db89ac67740615d6c891f0e7b6179326533011a07"
 
 [[package]]
 name = "js-sys"
-version = "0.3.102"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
+checksum = "53b44bfcdb3f8d5837a46dae1ca9660a837176eee74a28b229bc626816589102"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -4228,14 +4284,14 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libredox"
-version = "0.1.17"
+version = "0.1.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+checksum = "c943259e342f1e06ff2da7a83eabdfe7f92ce10262688dbf1895ff0b3e6e4652"
 dependencies = [
  "bitflags 2.13.0",
  "libc",
  "plain",
- "redox_syscall 0.8.1",
+ "redox_syscall 0.9.0",
 ]
 
 [[package]]
@@ -4331,6 +4387,19 @@ dependencies = [
  "sys-locale",
 ]
 
+[[package]]
+name = "loki-bench"
+version = "0.1.0"
+dependencies = [
+ "criterion",
+ "dhat",
+ "loki-doc-model",
+ "loki-layout",
+ "loki-odf",
+ "loki-ooxml",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "loki-convert"
 version = "0.1.0"
@@ -4370,7 +4439,7 @@ dependencies = [
  "indexmap",
  "loki-primitives",
  "loro",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -4478,6 +4547,7 @@ name = "loki-odf"
 version = "0.1.0"
 dependencies = [
  "appthere-color",
+ "appthere-conformance",
  "base64",
  "chrono",
  "indexmap",
@@ -4495,6 +4565,7 @@ name = "loki-ooxml"
 version = "0.1.0"
 dependencies = [
  "appthere-color",
+ "appthere-conformance",
  "base64",
  "chrono",
  "indexmap",
@@ -4623,7 +4694,6 @@ version = "0.1.0"
 dependencies = [
  "anyrender_vello",
  "appthere-canvas",
- "appthere-ui",
  "dioxus",
  "loki-doc-model",
  "loki-layout",
@@ -4824,11 +4894,13 @@ dependencies = [
  "android_logger",
  "anyrender_vello",
  "appthere-ui",
+ "base64",
  "blitz-shell",
  "dioxus",
  "dirs",
  "fontique 0.10.0",
  "futures-channel",
+ "image",
  "kurbo 0.12.0",
  "log",
  "loki-app-shell",
@@ -4906,9 +4978,9 @@ dependencies = [
 
 [[package]]
 name = "loro"
-version = "1.13.1"
+version = "1.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7bd1b63cd2f0cf66acbbb3191c41feaff03c94c3f6c6bb1e61d2ab3062c301c7"
+checksum = "221b567f34e3a7b38d05345b17797a7ca252d28e1fae479b4bb55c1a19616ddc"
 dependencies = [
  "enum-as-inner 0.6.1",
  "generic-btree",
@@ -4916,7 +4988,7 @@ dependencies = [
  "loro-delta",
  "loro-internal",
  "loro-kv-store",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "tracing",
 ]
 
@@ -4931,7 +5003,7 @@ dependencies = [
  "leb128",
  "loro-rle",
  "nonmax",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "serde",
  "serde_columnar",
  "serde_json",
@@ -4952,9 +5024,9 @@ dependencies = [
 
 [[package]]
 name = "loro-internal"
-version = "1.13.1"
+version = "1.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "252a84196402ac55a7dd064af87a747a430fc176ec744d5bb99f4ed92e639fa8"
+checksum = "fb15cd83866965b50b4893246699312624808a1f2e2d205432237287d947b822"
 dependencies = [
  "append-only-bytes",
  "arref",
@@ -4985,7 +5057,7 @@ dependencies = [
  "postcard",
  "pretty_assertions",
  "rand 0.8.6",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "serde",
  "serde_columnar",
  "serde_json",
@@ -5009,7 +5081,7 @@ dependencies = [
  "lz4_flex",
  "once_cell",
  "quick_cache",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "tracing",
  "xxhash-rust",
 ]
@@ -5224,9 +5296,9 @@ dependencies = [
 
 [[package]]
 name = "memmap2"
-version = "0.9.10"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714098028fe011992e1c3962653c96b2d578c4b4bce9036e15ff220319b1e0e3"
+checksum = "d1219ed1b7f229ee7104d281dd01d6802fe28bb6e95d292942c4daacdeb798c0"
 dependencies = [
  "libc",
 ]
@@ -5271,6 +5343,12 @@ dependencies = [
  "simd-adler32",
 ]
 
+[[package]]
+name = "mintex"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c505b3e17ed6b70a7ed2e67fbb2c560ee327353556120d6e72f5232b6880d536"
+
 [[package]]
 name = "mio"
 version = "1.2.1"
@@ -5413,9 +5491,9 @@ dependencies = [
 
 [[package]]
 name = "num-bigint"
-version = "0.4.6"
+version = "0.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+checksum = "c863e9ab5e7bf9c99ba75e1050f1e4d624ae87ed3532d6238ffbdc7b585dbbe6"
 dependencies = [
  "num-integer",
  "num-traits",
@@ -5914,6 +5992,15 @@ dependencies = [
  "objc2-foundation 0.3.2",
 ]
 
+[[package]]
+name = "object"
+version = "0.37.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff76201f031d8863c38aa7f905eca4f53abbfa15f609db4277d44cd8938f33fe"
+dependencies = [
+ "memchr",
+]
+
 [[package]]
 name = "object_store"
 version = "0.12.5"
@@ -6168,9 +6255,9 @@ checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
 [[package]]
 name = "pest"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0848c601009d37dfa3430c4666e147e49cdcf1b92ecd3e63657d8a5f19da662"
+checksum = "47627dd7305c6a2d6c8c6bcd24c5a4c17dbbf425f4f9c5313e724b38fc9782e9"
 dependencies = [
  "memchr",
  "ucd-trie",
@@ -6178,9 +6265,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11f486f1ea21e6c10ed15d5a7c77165d0ee443402f0780849d1768e7d9d6fe77"
+checksum = "4b4254325ecad416ab689e27ba51da03ba01a9632bc6e108f5fe7c3c4ad29d58"
 dependencies = [
  "pest",
  "pest_generator",
@@ -6188,9 +6275,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8040c4647b13b210a963c1ed407c1ff4fdfa01c31d6d2a098218702e6664f94f"
+checksum = "6c4c0e91ead7a8f7acecbca6f003fc2e8282b1dbe2dd9c9d2f16aba42995e0a7"
 dependencies = [
  "pest",
  "pest_meta",
@@ -6201,12 +6288,11 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.8.6"
+version = "2.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89815c69d36021a140146f26659a81d6c2afa33d216d736dd4be5381a7362220"
+checksum = "f9744bc48116fee06334924bb5f2bad41eed5e89bd26e29b0b799f9a3f82c210"
 dependencies = [
  "pest",
- "sha2",
 ]
 
 [[package]]
@@ -6494,6 +6580,12 @@ dependencies = [
  "toml_edit 0.25.12+spec-1.1.0",
 ]
 
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -6596,9 +6688,9 @@ dependencies = [
 
 [[package]]
 name = "quick_cache"
-version = "0.6.23"
+version = "0.6.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a3db184a8b66cfe87f0263a1de147a6b554c864d1767c6f7fa4eb0e5497b565"
+checksum = "b9c6658afe513a3b484e3abfdaa0d03ef3c0bbf017542c178dd55f94eb3051f9"
 dependencies = [
  "ahash",
  "equivalent",
@@ -6608,16 +6700,16 @@ dependencies = [
 
 [[package]]
 name = "quinn"
-version = "0.11.9"
+version = "0.11.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b9e20a958963c291dc322d98411f541009df2ced7b5a4f2bd52337638cfccf20"
+checksum = "0c1a41e437b6bbd489372cd4971de128e85c855f56c57f283d20ff016cf7c0a8"
 dependencies = [
  "bytes",
  "cfg_aliases",
  "pin-project-lite",
  "quinn-proto",
  "quinn-udp",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "rustls",
  "socket2",
  "thiserror 2.0.18",
@@ -6628,16 +6720,16 @@ dependencies = [
 
 [[package]]
 name = "quinn-proto"
-version = "0.11.14"
+version = "0.11.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
+checksum = "4fcb935c5bec503c2f0e306bdd3e58bb9029dcb14fa8d9ac76e3a5256ac0763e"
 dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
  "rand 0.9.4",
  "ring",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "rustls",
  "rustls-pki-types",
  "slab",
@@ -6663,9 +6755,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.45"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -6860,7 +6952,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "487889119a5f19ff7c0a20637196bdc76b9f54ebec17e3588b5d75e4999f8773"
 dependencies = [
  "bytemuck",
- "font-types 0.12.0",
+ "font-types 0.12.1",
  "once_cell",
 ]
 
@@ -6884,9 +6976,9 @@ dependencies = [
 
 [[package]]
 name = "redox_syscall"
-version = "0.8.1"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b44b894f2a6e36457d665d1e08c3866add6ed5e70050c1b4ba8a8ddedb02ce7"
+checksum = "c5102a6aaa05aa011a238e178e6bca86d2cb56fc9f586d37cb80f5bca6e07759"
 dependencies = [
  "bitflags 2.13.0",
 ]
@@ -7118,6 +7210,12 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "rustc-demangle"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
+
 [[package]]
 name = "rustc-hash"
 version = "1.1.0"
@@ -7126,9 +7224,9 @@ checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
 
 [[package]]
 name = "rustc-hash"
-version = "2.1.2"
+version = "2.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
+checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustc_version"
@@ -7167,9 +7265,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.40"
+version = "0.23.41"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
+checksum = "6b92b125634d9b795e7beca796cc790df15a7fb38323bf3196fda83292d06b1f"
 dependencies = [
  "log",
  "once_cell",
@@ -7194,9 +7292,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-pki-types"
-version = "1.14.1"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30a7197ae7eb376e574fe940d068c30fe0462554a3ddbe4eca7838e049c937a9"
+checksum = "764899a24af3980067ee14bc143654f297b22eaebfe3c7b6b211920a5a59b046"
 dependencies = [
  "web-time",
  "zeroize",
@@ -7323,7 +7421,7 @@ dependencies = [
  "phf",
  "phf_codegen",
  "precomputed-hash",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "servo_arc",
  "smallvec",
  "to_shmem",
@@ -8107,7 +8205,7 @@ dependencies = [
  "precomputed-hash",
  "rayon",
  "rayon-core",
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
  "selectors",
  "serde",
  "servo_arc",
@@ -8450,6 +8548,12 @@ dependencies = [
  "syn 2.0.118",
 ]
 
+[[package]]
+name = "thousands"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf63baf9f5039dadc247375c29eb13706706cfde997d0330d05aa63a77d8820"
+
 [[package]]
 name = "thread_local"
 version = "1.1.9"
@@ -8930,7 +9034,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb30dbbd9036155e74adad6812e9898d03ec374946234fbcebd5dfc7b9187b90"
 dependencies = [
- "rustc-hash 2.1.2",
+ "rustc-hash 2.1.3",
 ]
 
 [[package]]
@@ -8972,6 +9076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a28ba52c9b05311f4f6e62d5d9d46f094bd6e84cb8df7b3ef952748d752a7d05"
 dependencies = [
  "unic-langid-impl",
+ "unic-langid-macros",
 ]
 
 [[package]]
@@ -8983,6 +9088,30 @@ dependencies = [
  "tinystr",
 ]
 
+[[package]]
+name = "unic-langid-macros"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5957eb82e346d7add14182a3315a7e298f04e1ba4baac36f7f0dbfedba5fc25"
+dependencies = [
+ "proc-macro-hack",
+ "tinystr",
+ "unic-langid-impl",
+ "unic-langid-macros-impl",
+]
+
+[[package]]
+name = "unic-langid-macros-impl"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1249a628de3ad34b821ecb1001355bca3940bcb2f88558f1a8bd82e977f75b5"
+dependencies = [
+ "proc-macro-hack",
+ "quote",
+ "syn 2.0.118",
+ "unic-langid-impl",
+]
+
 [[package]]
 name = "unicode-bidi"
 version = "0.3.18"
@@ -9150,9 +9279,9 @@ checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
 
 [[package]]
 name = "utf8-width"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1292c0d970b54115d14f2492fe0170adf21d68a1de108eebc51c1df4f346a091"
+checksum = "159a7cadce548703edd50d24069bc294c5415ecab0a480e0cd1ca06d112dc94a"
 
 [[package]]
 name = "utf8-zero"
@@ -9174,9 +9303,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.3"
+version = "1.23.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "144d6b123cef80b301b8f72a9e2ca4370ddec21950d0a103dd22c437006d2db7"
+checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
@@ -9359,9 +9488,9 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
+checksum = "4b067c0c11094aef6b7a801c1e34a26affafdf3d051dba08456b868789aaf9a4"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -9372,9 +9501,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.75"
+version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "503b14d284f2c8dac03b819967e155ea753f573586193b2b2c95990cb5d69280"
+checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -9382,9 +9511,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
+checksum = "167ce5e579f6bcf889c4f7175a8a5a585de84e8ff93976ce393efa5f2837aab1"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -9392,9 +9521,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
+checksum = "f3997c7839262f4ef12cf90b818d6340c18e80f263f1a94bf157d0ec4420380e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -9405,9 +9534,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.125"
+version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
+checksum = "dc1b4cb0cc549fcf58d7dfc081778139b3d283a081644e833e84682ad71cea24"
 dependencies = [
  "unicode-ident",
 ]
@@ -9536,9 +9665,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.102"
+version = "0.3.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6430a72df5eb332242960fe84b3002a241163998241eb596d4f739b9757061d"
+checksum = "8622dcb61c0bcc9fffa6938bed81210af2da9a7e4a1a834b2e37a59b6dfb6141"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -10462,9 +10591,9 @@ checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
 [[package]]
 name = "xxhash-rust"
-version = "0.8.15"
+version = "0.8.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
+checksum = "4d93c89cdc2d3a63c3ec48ffe926931bdc069eafa8e4402fe6d8f790c9d1e576"
 
 [[package]]
 name = "yansi"
diff --git a/Cargo.toml b/Cargo.toml
index 94c40817..bd61ecfd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 resolver = "3"
-members = ["loki-doc-model","loki-sheet-model","loki-opc","loki-primitives","loki-ooxml","loki-odf","loki-layout","loki-vello","appthere-ui","loki-app-shell","loki-text","loki-spreadsheet","loki-presentation","loki-render-cache","loki-renderer","loki-i18n","appthere-canvas","loki-fonts","loki-graphics","loki-presentation-model","loki-epub","loki-pdf","loki-acid","loki-templates","loki-spell","loki-model","loki-crypto","loki-server-audit","loki-server-store","loki-server-collab","loki-server-auth","loki-server-api","loki-server","loki-convert","loki-print","loki-headless"]
+members = ["loki-doc-model","loki-sheet-model","loki-opc","loki-primitives","loki-ooxml","loki-odf","loki-layout","loki-vello","appthere-ui","loki-app-shell","loki-text","loki-spreadsheet","loki-presentation","loki-render-cache","loki-renderer","loki-i18n","appthere-canvas","loki-fonts","loki-graphics","loki-presentation-model","loki-epub","loki-pdf","loki-acid","loki-templates","loki-spell","appthere-conformance","loki-bench","loki-model","loki-crypto","loki-server-audit","loki-server-store","loki-server-collab","loki-server-auth","loki-server-api","loki-server","loki-convert","loki-print","loki-headless"]
 
 [workspace.dependencies]
 # Shared across appthere-ui and any other workspace member that needs Dioxus.
diff --git a/appthere-conformance/Cargo.toml b/appthere-conformance/Cargo.toml
new file mode 100644
index 00000000..28daf5e4
--- /dev/null
+++ b/appthere-conformance/Cargo.toml
@@ -0,0 +1,30 @@
+[package]
+name = "appthere-conformance"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+description = "Shared conformance-testing harness (schema validation, round-trip stability, visual goldens) for the AppThere Loki suite — Spec 02"
+repository = "https://github.com/appthere/loki"
+keywords = ["conformance", "testing", "ooxml", "odf", "loki"]
+categories = ["development-tools::testing"]
+
+[features]
+default = []
+# Adds the `model` adapter: `NormalizedModel` for the suite's format-neutral
+# `loki_doc_model::Document`, so the round-trip axis works on real documents.
+doc-model = ["dep:loki-doc-model"]
+# Adds the `sheet` adapter: `NormalizedModel` for `loki_sheet_model::Workbook`,
+# so the round-trip axis works on spreadsheets (XLSX / ODS).
+sheet-model = ["dep:loki-sheet-model"]
+
+[dependencies]
+thiserror = { workspace = true }
+# Round-trip the candidate XML through a temp file for `xmllint` validation.
+tempfile = "3"
+# Optional: the format-neutral document model, for the round-trip canonicalizer.
+loki-doc-model = { path = "../loki-doc-model", optional = true }
+# Optional: the spreadsheet model, for the workbook round-trip canonicalizer.
+loki-sheet-model = { path = "../loki-sheet-model", optional = true }
+
+[package.metadata.docs.rs]
+all-features = true
diff --git a/appthere-conformance/schemas/README.md b/appthere-conformance/schemas/README.md
new file mode 100644
index 00000000..c5df27b1
--- /dev/null
+++ b/appthere-conformance/schemas/README.md
@@ -0,0 +1,49 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Vendored schemas (Axis 1 — schema validation)
+
+The conformance schema axis validates Loki's exported XML against the **official,
+version-pinned** schemas, vendored here so validation is reproducible and offline
+(Spec 02 **D6**). `appthere_conformance::schema::XmllintValidator` points
+`xmllint` at these files.
+
+> **Status:** the validator and its plumbing are implemented and tested (against
+> small in-tree schemas in the unit tests). Vendoring the *full* official schema
+> sets below — and validating real DOCX/ODT exports against them — is the
+> immediate next step (Spec 02 M2 completion). They are not committed yet because
+> each is a large third-party drop with its own license/version that the
+> maintainer should pin deliberately.
+
+## What to vendor, and where
+
+| Path | Schema | Source / version to pin |
+|------|--------|--------------------------|
+| `ooxml/transitional/` | ISO/IEC 29500-1 **Transitional** XSDs (`wml.xsd`, `sml.xsd`, `dml-*.xsd`, `shared-*.xsd`, …) | ECMA-376 5th ed. Transitional schema bundle. Default validation target. |
+| `ooxml/strict/` | ISO/IEC 29500 **Strict** XSDs | Same bundle, Strict. Opt-in stricter pass. |
+| `opc/` | OPC: `opc-contentTypes.xsd`, `opc-relationships.xsd`, `opc-coreProperties.xsd` | ECMA-376 Part 2 (OPC). Exercises `loki-opc`. |
+| `odf/` | OASIS ODF **RELAX NG** (`OpenDocument-v1.3-schema.rng`) + `OpenDocument-v1.3-manifest-schema.rng` | OASIS ODF 1.3 schema. |
+
+Each subdirectory should also carry a `PROVENANCE.txt` recording the exact source
+URL, version/edition, retrieval date, and upstream license, so the pin is
+auditable.
+
+## How the validator uses them
+
+```rust
+use appthere_conformance::schema::{SchemaKind, SchemaValidator, XmllintValidator};
+
+let v = XmllintValidator::new()?;                       // fails loudly if xmllint absent
+let report = v.validate_bytes(
+    &exported_document_xml,
+    std::path::Path::new("appthere-conformance/schemas/ooxml/transitional/wml.xsd"),
+    SchemaKind::Xsd,
+)?;
+assert!(report.valid, "{:#?}", report.violations);      // first-class located violations
+```
+
+ODF parts use `SchemaKind::RelaxNg` against the `.rng` files. A schema *registry*
+that maps each emitted part (`document.xml`, `styles.xml`, `content.xml`,
+`manifest.xml`, `[Content_Types].xml`, …) to its schema file is the small wrapper
+to add once the files are vendored.
diff --git a/appthere-conformance/src/golden/mod.rs b/appthere-conformance/src/golden/mod.rs
new file mode 100644
index 00000000..1cd6afca
--- /dev/null
+++ b/appthere-conformance/src/golden/mod.rs
@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Axis 3 — visual goldens (trait + report types).
+//!
+//! A fixture is rendered by the reference app (the committed golden) and by Loki
+//! (the candidate), and the two are compared perceptually. Per Spec 02 **D2**,
+//! the candidate render uses an in-process `vello_cpu` software rasterizer so it
+//! is deterministic and GPU-free; per **§7.4** the metric is SSIM **plus**
+//! CIEDE2000/ΔE, scored **per region** with the *worst* region driving the
+//! result, against a **calibrated** threshold (not a guessed `0.98`).
+//!
+//! This module fixes the report shape and the [`GoldenHarness`] trait. The
+//! implementation — the `vello_cpu` candidate render, the ΔE/worst-region
+//! differ (promoting `loki-acid`'s SSIM machinery), heatmap emission, and the
+//! committed calibration record — is Spec 02 **M5** and intentionally *not*
+//! built here. The crate ships the other two axes today; the visual axis is
+//! advisory until M5 lands (which is exactly the M1 acceptance bar).
+
+use std::path::PathBuf;
+
+/// A perceptual score for one tiled region of a page.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct RegionScore {
+    /// Tile coordinates `(col, row)` within the page grid.
+    pub region: (u32, u32),
+    /// Structural similarity in `[0, 1]` (1 = identical).
+    pub ssim: f64,
+    /// Perceptual colour delta (CIEDE2000 ΔE); lower is closer.
+    pub delta_e: f64,
+}
+
+/// The perceptual comparison of one candidate page against its golden.
+///
+/// A page passes iff **every** region is within tolerance — the worst region,
+/// not the mean, drives the result, so a small localized failure is not averaged
+/// away (Spec 02 §7.4).
+#[derive(Clone, Debug, PartialEq)]
+pub struct PerceptualReport {
+    /// Per-region scores across the page grid.
+    pub regions: Vec<RegionScore>,
+    /// The single worst region (lowest SSIM / highest ΔE), if any regions exist.
+    pub worst: Option<RegionScore>,
+    /// Whether every region met its threshold.
+    pub passed: bool,
+    /// Optional path to an emitted heatmap-diff PNG for a failure.
+    pub heatmap: Option<PathBuf>,
+}
+
+/// Errors from the visual-goldens axis (render, golden load, diff).
+#[derive(Debug, thiserror::Error)]
+pub enum GoldenError {
+    /// No committed golden exists for the fixture.
+    #[error("no golden committed for fixture '{0}'")]
+    MissingGolden(String),
+    /// The visual axis is not yet implemented (Spec 02 M5).
+    #[error("visual goldens axis not yet implemented (Spec 02 M5): {0}")]
+    NotYetImplemented(&'static str),
+    /// An I/O error reading a golden or candidate image.
+    #[error("visual goldens I/O error: {0}")]
+    Io(#[source] std::io::Error),
+}
+
+/// Compares a candidate `vello_cpu` render of a fixture against its committed
+/// golden, region by region.
+///
+/// Implemented in Spec 02 M5 (the candidate render, perceptual diff, and
+/// calibration). The trait is defined now so consumers and the CI wiring can
+/// target a stable shape.
+pub trait GoldenHarness {
+    /// Compares the candidate render of `fixture_stem` (e.g. `acid_docx`)
+    /// against its golden, returning a per-page perceptual report.
+    fn compare(&self, fixture_stem: &str) -> Result<Vec<PerceptualReport>, GoldenError>;
+}
diff --git a/appthere-conformance/src/lib.rs b/appthere-conformance/src/lib.rs
new file mode 100644
index 00000000..238e82ce
--- /dev/null
+++ b/appthere-conformance/src/lib.rs
@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Shared conformance-testing harness for the AppThere Loki suite (Spec 02).
+//!
+//! Loki claims rendering and round-trip fidelity against Microsoft Office
+//! (OOXML) and LibreOffice (ODF). This crate verifies that on three independent
+//! axes, each failing for its own reason and pointing at its own bug class:
+//!
+//! 1. **Schema validation** ([`schema`]) — exported XML is well-formed against
+//!    the official OOXML (XSD) / ODF (RELAX NG) schemas. Catches malformed
+//!    output regardless of how it renders. **Implemented** (libxml2 backend).
+//! 2. **Round-trip stability** ([`roundtrip`]) — import → export → re-import
+//!    does not silently lose or mutate semantic content, compared on a
+//!    *normalized model*, never on bytes. The first-divergence differ is here;
+//!    the per-format `NormalizedModel` impls are the consumers' (Spec 02 M3).
+//! 3. **Visual goldens** ([`golden`]) — Loki's render matches a committed golden
+//!    within a calibrated perceptual tolerance. Trait + report types here; the
+//!    `vello_cpu` candidate render, ΔE/worst-region differ, and calibration are
+//!    Spec 02 M5 (and promote `loki-acid`'s SSIM machinery).
+//!
+//! All three are headless and GPU-free, which lets them run in CI.
+//!
+//! ## Status (Spec 02 milestones)
+//!
+//! This is the **M1 skeleton + M2 schema axis**. The schema axis is complete and
+//! tested; the round-trip first-divergence differ is implemented; the visual axis
+//! is trait + types pending M5. Promotion of `loki-acid`'s catalog / SSIM /
+//! golden-discovery into [`golden`] and the per-format model-equality impls are
+//! the next passes. A consuming app (Loki Text first) supplies a fixture corpus,
+//! a [`roundtrip::NormalizedModel`] impl, an importer/exporter pair, and (later)
+//! a CPU render entry point, and gets all three axes — the crate holds no
+//! Text-specific assumptions.
+
+#![forbid(unsafe_code)]
+
+pub mod golden;
+#[cfg(feature = "doc-model")]
+pub mod model;
+pub mod roundtrip;
+pub mod schema;
+#[cfg(feature = "sheet-model")]
+pub mod sheet;
+
+pub use roundtrip::{CanonicalEntry, Divergence, NormalizedModel, first_divergence};
+pub use schema::xmllint::XmllintValidator;
+pub use schema::{SchemaError, SchemaKind, SchemaReport, SchemaValidator, SchemaViolation};
diff --git a/appthere-conformance/src/model/meta.rs b/appthere-conformance/src/model/meta.rs
new file mode 100644
index 00000000..5deaee0d
--- /dev/null
+++ b/appthere-conformance/src/model/meta.rs
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Canonicalization of document metadata — the core properties, custom
+//! properties, and the extended Dublin Core set.
+//!
+//! Emitted under a `meta/…` path prefix so a dropped or mangled property
+//! (title, creator, a `dcmi:` term, a custom field) surfaces as a first
+//! divergence with a stable path, independent of document body content.
+//! Dates use RFC 3339 so the comparison is textual and timezone-stable.
+
+use loki_doc_model::meta::core::{CustomPropertyValue, DocumentMeta};
+
+use super::push;
+use crate::roundtrip::CanonicalEntry;
+
+/// Walks `meta` into canonical `meta/…` entries (nothing for unset fields).
+pub(super) fn canonicalize_meta(meta: &DocumentMeta, out: &mut Vec<CanonicalEntry>) {
+    opt(out, "title", meta.title.as_deref());
+    opt(out, "subject", meta.subject.as_deref());
+    opt(out, "keywords", meta.keywords.as_deref());
+    opt(out, "description", meta.description.as_deref());
+    opt(out, "creator", meta.creator.as_deref());
+    opt(out, "last_modified_by", meta.last_modified_by.as_deref());
+    if let Some(d) = meta.created {
+        push(out, "meta/created".to_string(), d.to_rfc3339());
+    }
+    if let Some(d) = meta.modified {
+        push(out, "meta/modified".to_string(), d.to_rfc3339());
+    }
+    if let Some(l) = &meta.language {
+        push(out, "meta/language".to_string(), l.as_str().to_string());
+    }
+    if let Some(r) = meta.revision {
+        push(out, "meta/revision".to_string(), r.to_string());
+    }
+    if let Some(e) = meta.editing_duration_minutes {
+        push(out, "meta/editing_minutes".to_string(), e.to_string());
+    }
+    // Custom properties, sorted by name so the entry order is stable.
+    let mut custom: Vec<_> = meta.custom_properties.iter().collect();
+    custom.sort_by(|a, b| a.name.cmp(&b.name));
+    for p in custom {
+        push(
+            out,
+            format!("meta/custom/{}", p.name),
+            custom_value(&p.value),
+        );
+    }
+    // Extended Dublin Core — already a flat, deterministic name/value list.
+    for (name, value) in meta.dublin_core.to_named_pairs() {
+        push(out, format!("meta/dc/{name}"), value);
+    }
+}
+
+fn opt(out: &mut Vec<CanonicalEntry>, key: &str, v: Option<&str>) {
+    if let Some(s) = v {
+        push(out, format!("meta/{key}"), s.to_string());
+    }
+}
+
+fn custom_value(v: &CustomPropertyValue) -> String {
+    match v {
+        CustomPropertyValue::Text(s) => s.clone(),
+        CustomPropertyValue::Number(n) => format!("{n}"),
+        CustomPropertyValue::Bool(b) => b.to_string(),
+        CustomPropertyValue::DateTime(d) => d.to_rfc3339(),
+        // `CustomPropertyValue` is `#[non_exhaustive]`; record any future
+        // variant by a marker so its presence is still tracked.
+        _ => "unknown".to_string(),
+    }
+}
diff --git a/appthere-conformance/src/model/mod.rs b/appthere-conformance/src/model/mod.rs
new file mode 100644
index 00000000..cfe30e60
--- /dev/null
+++ b/appthere-conformance/src/model/mod.rs
@@ -0,0 +1,229 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Round-trip canonicalization for the suite's format-neutral document model.
+//!
+//! Implements [`NormalizedModel`](crate::roundtrip::NormalizedModel) for
+//! `loki_doc_model::Document` (feature `doc-model`), so the round-trip axis works
+//! on real documents. The canonical form is an order-stable sequence of
+//! `(path, value)` entries that captures the *semantically significant* content
+//! — paragraph structure and text, run-level character formatting (direct
+//! [`CharProps`] and the Pandoc emphasis wrappers), style references, and
+//! **bookmark ids** (the named round-trip class, Spec 02 §6) — while ignoring
+//! incidental differences. [`crate::roundtrip::first_divergence`] then pinpoints
+//! the first loss with a model path.
+//!
+//! Coverage is the common word-processing shapes (paragraphs, headings, styled
+//! paragraphs, lists, quotes, runs, links, bookmarks); other block/inline kinds
+//! are recorded by *kind* (so a structural change is still caught) and deepened
+//! in a follow-up. Document metadata and table interiors are likewise a
+//! follow-up. The shape is extensible: each pass adds entries, never changes the
+//! comparison engine.
+
+use loki_doc_model::Document;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::Inline;
+use loki_doc_model::style::props::char_props::CharProps;
+
+use crate::roundtrip::{CanonicalEntry, NormalizedModel};
+
+mod meta;
+mod tables;
+
+impl NormalizedModel for Document {
+    fn canonical(&self) -> Vec<CanonicalEntry> {
+        canonicalize_document(self)
+    }
+}
+
+/// Produces the canonical `(path, value)` form of `doc` (see the module docs).
+#[must_use]
+pub fn canonicalize_document(doc: &Document) -> Vec<CanonicalEntry> {
+    let mut out = Vec::new();
+    meta::canonicalize_meta(&doc.meta, &mut out);
+    for (si, section) in doc.sections.iter().enumerate() {
+        for (bi, block) in section.blocks.iter().enumerate() {
+            walk_block(block, &format!("sec{si:04}/blk{bi:04}"), &mut out);
+        }
+    }
+    out
+}
+
+fn push(out: &mut Vec<CanonicalEntry>, path: String, value: impl Into<String>) {
+    out.push(CanonicalEntry::new(path, value));
+}
+
+fn walk_block(block: &Block, path: &str, out: &mut Vec<CanonicalEntry>) {
+    push(out, format!("{path}/kind"), block_kind(block));
+    match block {
+        Block::Plain(inlines) | Block::Para(inlines) => walk_inlines(inlines, path, out),
+        Block::Heading(level, _, inlines) => {
+            push(out, format!("{path}/level"), level.to_string());
+            walk_inlines(inlines, path, out);
+        }
+        Block::StyledPara(sp) => {
+            if let Some(id) = &sp.style_id {
+                push(out, format!("{path}/style"), id.0.clone());
+            }
+            if let Some(props) = &sp.direct_char_props {
+                push(out, format!("{path}/mark_props"), char_summary(props));
+            }
+            walk_inlines(&sp.inlines, path, out);
+        }
+        Block::BlockQuote(blocks) => {
+            for (i, b) in blocks.iter().enumerate() {
+                walk_block(b, &format!("{path}/q{i:04}"), out);
+            }
+        }
+        Block::OrderedList(_, items) | Block::BulletList(items) => {
+            for (li, item) in items.iter().enumerate() {
+                for (bi, b) in item.iter().enumerate() {
+                    walk_block(b, &format!("{path}/li{li:04}/{bi:04}"), out);
+                }
+            }
+        }
+        Block::CodeBlock(_, code) | Block::RawBlock(_, code) => {
+            push(out, format!("{path}/text"), code.clone());
+        }
+        Block::Table(tbl) => tables::walk_table(tbl, path, out),
+        // Other kinds: recorded by `kind` above; deep walk is a follow-up.
+        _ => {}
+    }
+}
+
+fn walk_inlines(inlines: &[Inline], path: &str, out: &mut Vec<CanonicalEntry>) {
+    for (i, inl) in inlines.iter().enumerate() {
+        walk_inline(inl, &format!("{path}/i{i:04}"), out);
+    }
+}
+
+fn walk_inline(inl: &Inline, path: &str, out: &mut Vec<CanonicalEntry>) {
+    push(out, format!("{path}/kind"), inline_kind(inl));
+    match inl {
+        Inline::Str(s) => push(out, format!("{path}/str"), s.clone()),
+        // Emphasis wrappers: the `kind` above records the mark; recurse content.
+        Inline::Emph(c)
+        | Inline::Underline(c)
+        | Inline::Strong(c)
+        | Inline::Strikeout(c)
+        | Inline::Superscript(c)
+        | Inline::Subscript(c)
+        | Inline::SmallCaps(c) => walk_inlines(c, path, out),
+        Inline::StyledRun(sr) => {
+            if let Some(id) = &sr.style_id {
+                push(out, format!("{path}/style"), id.0.clone());
+            }
+            if let Some(props) = &sr.direct_props {
+                push(out, format!("{path}/props"), char_summary(props));
+            }
+            walk_inlines(&sr.content, path, out);
+        }
+        Inline::Bookmark(kind, id) => {
+            push(out, format!("{path}/id"), format!("{kind:?}:{id}"));
+        }
+        Inline::Link(_, c, _)
+        | Inline::Image(_, c, _)
+        | Inline::Span(_, c)
+        | Inline::Quoted(_, c) => {
+            walk_inlines(c, path, out);
+        }
+        // Space / breaks / fields / math / notes / etc.: `kind` is enough here.
+        _ => {}
+    }
+}
+
+/// A compact, stable serialization of the *set* direct character properties.
+/// Only `Some` fields appear, in a fixed order, so dropping any one property
+/// changes the string — and the round-trip differ catches it.
+fn char_summary(p: &CharProps) -> String {
+    let mut parts: Vec<String> = Vec::new();
+    if let Some(v) = &p.font_name {
+        parts.push(format!("font={v}"));
+    }
+    if let Some(v) = &p.font_size {
+        parts.push(format!("size={v:?}"));
+    }
+    if let Some(v) = p.bold {
+        parts.push(format!("bold={v}"));
+    }
+    if let Some(v) = p.italic {
+        parts.push(format!("italic={v}"));
+    }
+    if let Some(v) = &p.underline {
+        parts.push(format!("underline={v:?}"));
+    }
+    if let Some(v) = &p.strikethrough {
+        parts.push(format!("strike={v:?}"));
+    }
+    if let Some(v) = p.small_caps {
+        parts.push(format!("smallcaps={v}"));
+    }
+    if let Some(v) = &p.vertical_align {
+        parts.push(format!("valign={v:?}"));
+    }
+    if let Some(v) = &p.color {
+        parts.push(format!("color={v:?}"));
+    }
+    parts.join(";")
+}
+
+fn block_kind(b: &Block) -> &'static str {
+    match b {
+        Block::Plain(_) => "plain",
+        Block::Para(_) => "para",
+        Block::LineBlock(_) => "lineblock",
+        Block::CodeBlock(_, _) => "codeblock",
+        Block::RawBlock(_, _) => "rawblock",
+        Block::BlockQuote(_) => "blockquote",
+        Block::OrderedList(_, _) => "orderedlist",
+        Block::BulletList(_) => "bulletlist",
+        Block::DefinitionList(_) => "definitionlist",
+        Block::Heading(_, _, _) => "heading",
+        Block::HorizontalRule => "horizontalrule",
+        Block::Table(_) => "table",
+        Block::Figure(_, _, _) => "figure",
+        Block::Div(_, _) => "div",
+        Block::StyledPara(_) => "styledpara",
+        Block::TableOfContents(_) => "tableofcontents",
+        Block::Index(_) => "index",
+        Block::NotesBlock(_) => "notesblock",
+        // `Block` is `#[non_exhaustive]`; track any future variant by a marker.
+        _ => "unknown",
+    }
+}
+
+fn inline_kind(i: &Inline) -> &'static str {
+    match i {
+        Inline::Str(_) => "str",
+        Inline::Emph(_) => "emph",
+        Inline::Underline(_) => "underline",
+        Inline::Strong(_) => "strong",
+        Inline::Strikeout(_) => "strikeout",
+        Inline::Superscript(_) => "superscript",
+        Inline::Subscript(_) => "subscript",
+        Inline::SmallCaps(_) => "smallcaps",
+        Inline::Quoted(_, _) => "quoted",
+        Inline::Cite(_, _) => "cite",
+        Inline::Code(_, _) => "code",
+        Inline::Space => "space",
+        Inline::SoftBreak => "softbreak",
+        Inline::LineBreak => "linebreak",
+        Inline::Math(_, _) => "math",
+        Inline::RawInline(_, _) => "rawinline",
+        Inline::Link(_, _, _) => "link",
+        Inline::Image(_, _, _) => "image",
+        Inline::Note(_, _) => "note",
+        Inline::Span(_, _) => "span",
+        Inline::StyledRun(_) => "styledrun",
+        Inline::Field(_) => "field",
+        Inline::Comment(_) => "comment",
+        Inline::Bookmark(_, _) => "bookmark",
+        // `Inline` is `#[non_exhaustive]`; record any future variant by a marker
+        // so its presence is still tracked (and deepened in a follow-up).
+        _ => "unknown",
+    }
+}
+
+#[cfg(test)]
+#[path = "model_tests.rs"]
+mod tests;
diff --git a/appthere-conformance/src/model/model_tests.rs b/appthere-conformance/src/model/model_tests.rs
new file mode 100644
index 00000000..65a7443e
--- /dev/null
+++ b/appthere-conformance/src/model/model_tests.rs
@@ -0,0 +1,218 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use loki_doc_model::Document;
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{BookmarkKind, Inline, StyledRun};
+use loki_doc_model::content::table::core::{Table, TableBody, TableCaption, TableFoot, TableHead};
+use loki_doc_model::content::table::row::{Cell, Row};
+use loki_doc_model::layout::section::Section;
+use loki_doc_model::style::props::char_props::CharProps;
+
+use crate::roundtrip::diff_models;
+
+/// A one-section document with the given blocks.
+fn doc(blocks: Vec<Block>) -> Document {
+    let mut d = Document::default();
+    let mut s = Section::new();
+    s.blocks = blocks;
+    d.sections = vec![s];
+    d
+}
+
+fn str_(s: &str) -> Inline {
+    Inline::Str(s.to_string())
+}
+
+/// A run with the given direct character props around one text inline.
+fn run(text: &str, props: Option<CharProps>) -> Inline {
+    Inline::StyledRun(StyledRun {
+        style_id: None,
+        direct_props: props.map(Box::new),
+        content: vec![str_(text)],
+        attr: NodeAttr::default(),
+    })
+}
+
+#[test]
+fn identical_documents_round_trip_clean() {
+    let d = doc(vec![Block::Para(vec![
+        str_("hello"),
+        Inline::Space,
+        str_("world"),
+    ])]);
+    assert_eq!(diff_models(&d, &d.clone()), None);
+}
+
+#[test]
+fn dropped_run_property_is_caught_with_a_path() {
+    let bold = CharProps {
+        bold: Some(true),
+        ..Default::default()
+    };
+    let a = doc(vec![Block::Para(vec![run("x", Some(bold))])]);
+    // Export drops the run's direct formatting entirely.
+    let b = doc(vec![Block::Para(vec![run("x", None)])]);
+
+    let d = diff_models(&a, &b).expect("dropped bold must be caught");
+    assert!(d.path.ends_with("/props"), "path = {}", d.path);
+    assert!(d.left.as_deref().unwrap_or_default().contains("bold=true"));
+    assert!(d.right.is_none(), "right should lack the props entry");
+}
+
+#[test]
+fn changed_run_property_reports_both_sides() {
+    let a = doc(vec![Block::Para(vec![run(
+        "x",
+        Some(CharProps {
+            bold: Some(true),
+            ..Default::default()
+        }),
+    )])]);
+    let b = doc(vec![Block::Para(vec![run(
+        "x",
+        Some(CharProps {
+            italic: Some(true),
+            ..Default::default()
+        }),
+    )])]);
+
+    let d = diff_models(&a, &b).expect("bold→italic must be caught");
+    assert!(d.path.ends_with("/props"));
+    assert_eq!(d.left.as_deref(), Some("bold=true"));
+    assert_eq!(d.right.as_deref(), Some("italic=true"));
+}
+
+#[test]
+fn mangled_bookmark_id_is_caught() {
+    let a = doc(vec![Block::Para(vec![
+        Inline::Bookmark(BookmarkKind::Start, "_Ref1".to_string()),
+        str_("anchored"),
+    ])]);
+    let b = doc(vec![Block::Para(vec![
+        Inline::Bookmark(BookmarkKind::Start, "_Ref2".to_string()),
+        str_("anchored"),
+    ])]);
+
+    let d = diff_models(&a, &b).expect("mangled bookmark id must be caught");
+    assert!(d.path.ends_with("/id"), "path = {}", d.path);
+    assert!(d.left.as_deref().unwrap_or_default().contains("_Ref1"));
+    assert!(d.right.as_deref().unwrap_or_default().contains("_Ref2"));
+}
+
+#[test]
+fn dropped_text_is_caught() {
+    let a = doc(vec![Block::Para(vec![
+        str_("hello"),
+        Inline::Space,
+        str_("world"),
+    ])]);
+    let b = doc(vec![Block::Para(vec![
+        str_("hello"),
+        Inline::Space,
+        str_("there"),
+    ])]);
+    let d = diff_models(&a, &b).expect("changed word must be caught");
+    assert!(d.path.ends_with("/str"));
+    assert_eq!(d.left.as_deref(), Some("world"));
+    assert_eq!(d.right.as_deref(), Some("there"));
+}
+
+#[test]
+fn structural_change_is_caught_by_kind() {
+    // A paragraph replaced by a heading: the `kind` entry diverges.
+    let a = doc(vec![Block::Para(vec![str_("title")])]);
+    let b = doc(vec![Block::Heading(
+        1,
+        NodeAttr::default(),
+        vec![str_("title")],
+    )]);
+    let d = diff_models(&a, &b).expect("para→heading must be caught");
+    assert!(d.path.ends_with("/kind"));
+    assert_eq!(d.left.as_deref(), Some("para"));
+    assert_eq!(d.right.as_deref(), Some("heading"));
+}
+
+/// A single-body table whose cells hold the given paragraph texts.
+fn table(rows: Vec<Vec<&str>>) -> Block {
+    let body_rows = rows
+        .into_iter()
+        .map(|cells| {
+            Row::new(
+                cells
+                    .into_iter()
+                    .map(|t| Cell::simple(vec![Block::Para(vec![str_(t)])]))
+                    .collect(),
+            )
+        })
+        .collect();
+    Block::Table(Box::new(Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(body_rows)],
+        foot: TableFoot::empty(),
+    }))
+}
+
+#[test]
+fn dropped_cell_text_is_caught_with_a_table_path() {
+    let a = doc(vec![table(vec![vec!["A1", "A2"], vec!["B1", "B2"]])]);
+    // The bottom-right cell loses its text on export.
+    let b = doc(vec![table(vec![vec!["A1", "A2"], vec!["B1", ""]])]);
+
+    let d = diff_models(&a, &b).expect("dropped cell text must be caught");
+    assert!(d.path.contains("/c0001/"), "path = {}", d.path);
+    assert_eq!(d.left.as_deref(), Some("B2"));
+    assert_eq!(d.right.as_deref(), Some(""));
+}
+
+#[test]
+fn merged_cell_span_change_is_caught() {
+    let mut a_cell = Cell::simple(vec![Block::Para(vec![str_("x")])]);
+    a_cell.col_span = 2;
+    let a = doc(vec![Block::Table(Box::new(Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![a_cell])])],
+        foot: TableFoot::empty(),
+    }))]);
+    // Re-import drops the col-span (cell de-merged to 1×1).
+    let b = doc(vec![table(vec![vec!["x"]])]);
+
+    let d = diff_models(&a, &b).expect("lost col-span must be caught");
+    assert!(d.path.ends_with("/span"), "path = {}", d.path);
+    assert_eq!(d.left.as_deref(), Some("1x2"));
+    assert!(d.right.is_none(), "right should lack the span entry");
+}
+
+#[test]
+fn dropped_metadata_title_is_caught() {
+    let mut a = doc(vec![Block::Para(vec![str_("body")])]);
+    a.meta.title = Some("My Report".to_string());
+    let b = doc(vec![Block::Para(vec![str_("body")])]);
+
+    let d = diff_models(&a, &b).expect("dropped title must be caught");
+    assert_eq!(d.path, "meta/title");
+    assert_eq!(d.left.as_deref(), Some("My Report"));
+    assert!(d.right.is_none());
+}
+
+#[test]
+fn changed_metadata_creator_reports_both_sides() {
+    let mut a = doc(vec![Block::Para(vec![str_("body")])]);
+    a.meta.creator = Some("Ada".to_string());
+    let mut b = doc(vec![Block::Para(vec![str_("body")])]);
+    b.meta.creator = Some("Grace".to_string());
+
+    let d = diff_models(&a, &b).expect("changed creator must be caught");
+    assert_eq!(d.path, "meta/creator");
+    assert_eq!(d.left.as_deref(), Some("Ada"));
+    assert_eq!(d.right.as_deref(), Some("Grace"));
+}
diff --git a/appthere-conformance/src/model/tables.rs b/appthere-conformance/src/model/tables.rs
new file mode 100644
index 00000000..1f2186fd
--- /dev/null
+++ b/appthere-conformance/src/model/tables.rs
@@ -0,0 +1,63 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Canonicalization of table interiors — column count, caption, and every row
+//! (head, per-body head + body, foot) with each cell's span and block content.
+//!
+//! Cell blocks recurse through the parent module's [`walk_block`](super::walk_block),
+//! so a table cell containing a styled paragraph, a list, or a nested table is
+//! canonicalised to the same depth as top-level content. A dropped row, a
+//! merged-away cell, or lost cell text therefore surfaces as a first divergence
+//! with a `…/tbl/br0001/c0000/…` path.
+
+use loki_doc_model::content::table::core::Table;
+use loki_doc_model::content::table::row::Row;
+
+use super::{push, walk_block, walk_inlines};
+use crate::roundtrip::CanonicalEntry;
+
+/// Walks `tbl` into canonical entries under `path`.
+pub(super) fn walk_table(tbl: &Table, path: &str, out: &mut Vec<CanonicalEntry>) {
+    push(out, format!("{path}/cols"), tbl.col_specs.len().to_string());
+    if !tbl.caption.full.is_empty() {
+        walk_inlines(&tbl.caption.full, &format!("{path}/caption"), out);
+    }
+    // A single monotonic row index across head/body/foot keeps the path stable
+    // even if rows move between groups (the `group` letter records the section).
+    let mut row_idx = 0usize;
+    for row in &tbl.head.rows {
+        walk_row(row, path, 'h', &mut row_idx, out);
+    }
+    for body in &tbl.bodies {
+        for row in body.head_rows.iter().chain(body.body_rows.iter()) {
+            walk_row(row, path, 'b', &mut row_idx, out);
+        }
+    }
+    for row in &tbl.foot.rows {
+        walk_row(row, path, 'f', &mut row_idx, out);
+    }
+}
+
+fn walk_row(
+    row: &Row,
+    path: &str,
+    group: char,
+    row_idx: &mut usize,
+    out: &mut Vec<CanonicalEntry>,
+) {
+    let rp = format!("{path}/{group}r{:04}", *row_idx);
+    *row_idx += 1;
+    for (ci, cell) in row.cells.iter().enumerate() {
+        let cp = format!("{rp}/c{ci:04}");
+        if cell.row_span != 1 || cell.col_span != 1 {
+            push(
+                out,
+                format!("{cp}/span"),
+                format!("{}x{}", cell.row_span, cell.col_span),
+            );
+        }
+        for (bi, b) in cell.blocks.iter().enumerate() {
+            walk_block(b, &format!("{cp}/{bi:04}"), out);
+        }
+    }
+}
diff --git a/appthere-conformance/src/roundtrip/mod.rs b/appthere-conformance/src/roundtrip/mod.rs
new file mode 100644
index 00000000..adf6937b
--- /dev/null
+++ b/appthere-conformance/src/roundtrip/mod.rs
@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Axis 2 — round-trip stability.
+//!
+//! Importing, exporting, and re-importing a document must not silently lose or
+//! mutate semantic content. Comparison is on a **normalized model**, never on
+//! bytes: a consumer implements [`NormalizedModel`] for its model type, yielding
+//! an order-stable sequence of `(path, value)` [`CanonicalEntry`]s that elides
+//! semantically-insignificant differences (element ordering, whitespace,
+//! default values) but preserves real content (a dropped run property, a
+//! collapsed style, a mangled bookmark id).
+//!
+//! [`first_divergence`] then reports the **first divergence with a model path**
+//! — not just a boolean — so a round-trip failure is diagnosable (Spec 02 §6).
+//! The three round-trip *shapes* (native, import-export-import,
+//! reference-anchored) and the per-format `NormalizedModel` impls are the
+//! consumers' to supply (Spec 02 M3); this module is the shared, format-neutral
+//! comparison engine.
+
+/// One entry in a model's canonical form: a stable path and its value.
+///
+/// Paths should be unique and structural, e.g. `body/para[3]/run[0]/bold`. The
+/// comparison is order-insensitive (entries are sorted by path), so the consumer
+/// need not emit them in any particular order.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct CanonicalEntry {
+    /// Structural path identifying this value within the model.
+    pub path: String,
+    /// The normalized value at `path`.
+    pub value: String,
+}
+
+impl CanonicalEntry {
+    /// Convenience constructor.
+    pub fn new(path: impl Into<String>, value: impl Into<String>) -> Self {
+        Self {
+            path: path.into(),
+            value: value.into(),
+        }
+    }
+}
+
+/// A model that can produce an order-stable canonical form for comparison.
+pub trait NormalizedModel {
+    /// The canonical `(path, value)` entries. Order does not matter
+    /// ([`first_divergence`] sorts by path); paths should be unique.
+    fn canonical(&self) -> Vec<CanonicalEntry>;
+}
+
+/// The first place two canonical forms differ.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct Divergence {
+    /// The model path at which the forms first diverge.
+    pub path: String,
+    /// The left (e.g. originally-imported) value at `path`, or `None` if the
+    /// left form has no entry there.
+    pub left: Option<String>,
+    /// The right (re-imported) value at `path`, or `None` if absent there.
+    pub right: Option<String>,
+}
+
+/// Returns the first divergence between two canonical forms, or `None` if they
+/// are equal under the normalized comparison.
+///
+/// Both forms are sorted by path, then merge-walked: a path present in only one
+/// form, or a differing value at a shared path, is the divergence. Reporting the
+/// *first* (lowest-path) divergence keeps failures diagnosable.
+#[must_use]
+pub fn first_divergence(left: &[CanonicalEntry], right: &[CanonicalEntry]) -> Option<Divergence> {
+    let mut l: Vec<&CanonicalEntry> = left.iter().collect();
+    let mut r: Vec<&CanonicalEntry> = right.iter().collect();
+    l.sort_by(|a, b| a.path.cmp(&b.path));
+    r.sort_by(|a, b| a.path.cmp(&b.path));
+
+    let (mut i, mut j) = (0usize, 0usize);
+    while i < l.len() && j < r.len() {
+        match l[i].path.cmp(&r[j].path) {
+            std::cmp::Ordering::Less => {
+                return Some(Divergence {
+                    path: l[i].path.clone(),
+                    left: Some(l[i].value.clone()),
+                    right: None,
+                });
+            }
+            std::cmp::Ordering::Greater => {
+                return Some(Divergence {
+                    path: r[j].path.clone(),
+                    left: None,
+                    right: Some(r[j].value.clone()),
+                });
+            }
+            std::cmp::Ordering::Equal => {
+                if l[i].value != r[j].value {
+                    return Some(Divergence {
+                        path: l[i].path.clone(),
+                        left: Some(l[i].value.clone()),
+                        right: Some(r[j].value.clone()),
+                    });
+                }
+                i += 1;
+                j += 1;
+            }
+        }
+    }
+    if let Some(e) = l.get(i) {
+        return Some(Divergence {
+            path: e.path.clone(),
+            left: Some(e.value.clone()),
+            right: None,
+        });
+    }
+    if let Some(e) = r.get(j) {
+        return Some(Divergence {
+            path: e.path.clone(),
+            left: None,
+            right: Some(e.value.clone()),
+        });
+    }
+    None
+}
+
+/// Compares two [`NormalizedModel`]s, returning the first [`Divergence`] or
+/// `None` if they round-trip equal.
+#[must_use]
+pub fn diff_models<M: NormalizedModel>(left: &M, right: &M) -> Option<Divergence> {
+    first_divergence(&left.canonical(), &right.canonical())
+}
+
+#[cfg(test)]
+#[path = "roundtrip_tests.rs"]
+mod tests;
diff --git a/appthere-conformance/src/roundtrip/roundtrip_tests.rs b/appthere-conformance/src/roundtrip/roundtrip_tests.rs
new file mode 100644
index 00000000..a64f2d91
--- /dev/null
+++ b/appthere-conformance/src/roundtrip/roundtrip_tests.rs
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::{CanonicalEntry, Divergence, NormalizedModel, diff_models, first_divergence};
+
+fn e(path: &str, value: &str) -> CanonicalEntry {
+    CanonicalEntry::new(path, value)
+}
+
+#[test]
+fn equal_forms_have_no_divergence() {
+    let a = vec![e("body/p[0]/text", "hi"), e("body/p[0]/bold", "true")];
+    let b = a.clone();
+    assert_eq!(first_divergence(&a, &b), None);
+}
+
+#[test]
+fn comparison_is_order_insensitive() {
+    let a = vec![e("a", "1"), e("b", "2"), e("c", "3")];
+    let b = vec![e("c", "3"), e("a", "1"), e("b", "2")];
+    assert_eq!(first_divergence(&a, &b), None);
+}
+
+#[test]
+fn value_mismatch_reports_both_sides_at_the_path() {
+    let a = vec![e("body/p[0]/bold", "true")];
+    let b = vec![e("body/p[0]/bold", "false")];
+    assert_eq!(
+        first_divergence(&a, &b),
+        Some(Divergence {
+            path: "body/p[0]/bold".to_string(),
+            left: Some("true".to_string()),
+            right: Some("false".to_string()),
+        })
+    );
+}
+
+#[test]
+fn dropped_entry_reports_left_only() {
+    // The classic round-trip loss: export drops a run property the import kept.
+    let a = vec![e("p[0]/bold", "true"), e("p[0]/italic", "true")];
+    let b = vec![e("p[0]/bold", "true")];
+    assert_eq!(
+        first_divergence(&a, &b),
+        Some(Divergence {
+            path: "p[0]/italic".to_string(),
+            left: Some("true".to_string()),
+            right: None,
+        })
+    );
+}
+
+#[test]
+fn added_entry_reports_right_only() {
+    let a = vec![e("p[0]/bold", "true")];
+    let b = vec![e("p[0]/bold", "true"), e("p[0]/strike", "true")];
+    assert_eq!(
+        first_divergence(&a, &b),
+        Some(Divergence {
+            path: "p[0]/strike".to_string(),
+            left: None,
+            right: Some("true".to_string()),
+        })
+    );
+}
+
+#[test]
+fn first_divergence_is_the_lowest_path() {
+    // Two differ; the lower path (`a`) is reported, not `z`.
+    let a = vec![e("a", "1"), e("z", "9")];
+    let b = vec![e("a", "2"), e("z", "8")];
+    assert_eq!(first_divergence(&a, &b).unwrap().path, "a");
+}
+
+struct Doc(Vec<CanonicalEntry>);
+impl NormalizedModel for Doc {
+    fn canonical(&self) -> Vec<CanonicalEntry> {
+        self.0.clone()
+    }
+}
+
+#[test]
+fn diff_models_uses_the_trait() {
+    let a = Doc(vec![e("bookmark/id", "_Ref1")]);
+    let b = Doc(vec![e("bookmark/id", "_Ref2")]); // mangled bookmark id
+    let d = diff_models(&a, &b).expect("ids differ");
+    assert_eq!(d.path, "bookmark/id");
+    assert_eq!(d.left.as_deref(), Some("_Ref1"));
+    assert_eq!(d.right.as_deref(), Some("_Ref2"));
+}
diff --git a/appthere-conformance/src/schema/mod.rs b/appthere-conformance/src/schema/mod.rs
new file mode 100644
index 00000000..20baa112
--- /dev/null
+++ b/appthere-conformance/src/schema/mod.rs
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Axis 1 — schema validation.
+//!
+//! Every export the harness produces is validated against the official schema
+//! *before* any rendering question is asked: OOXML parts against the ISO/IEC
+//! 29500 XSDs (Transitional by default, Strict opt-in) and the OPC package
+//! layer; ODF against the OASIS RELAX NG schema and manifest.
+//!
+//! [`SchemaValidator`] is the backend-agnostic trait. The shipping
+//! implementation ([`xmllint::XmllintValidator`]) shells to `libxml2`'s
+//! `xmllint`; a future pure-Rust backend can replace it without touching
+//! consumers. Validator availability is checked explicitly — a missing
+//! `xmllint` fails loudly, never silently skips (Spec 02 §5).
+//!
+//! The schemas themselves are vendored and version-pinned under `schemas/`
+//! (see `schemas/README.md`) so validation is reproducible and offline (D6).
+
+use std::path::Path;
+
+pub mod xmllint;
+
+/// The schema language a validation runs against.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SchemaKind {
+    /// W3C XML Schema (`.xsd`) — used for ISO/IEC 29500 (OOXML).
+    Xsd,
+    /// RELAX NG (`.rng`) — used for the OASIS ODF schema.
+    RelaxNg,
+}
+
+impl SchemaKind {
+    /// The `xmllint` flag selecting this schema language.
+    #[must_use]
+    pub fn xmllint_flag(self) -> &'static str {
+        match self {
+            SchemaKind::Xsd => "--schema",
+            SchemaKind::RelaxNg => "--relaxng",
+        }
+    }
+}
+
+/// A single schema-validity error, located in the candidate document.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SchemaViolation {
+    /// 1-based line in the candidate XML, if the validator reported one.
+    pub line: Option<u32>,
+    /// Human-readable description from the validator.
+    pub message: String,
+}
+
+/// The outcome of validating one XML document against one schema.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct SchemaReport {
+    /// `true` iff the document is schema-valid (no violations).
+    pub valid: bool,
+    /// Each reported violation, in document order. Empty when `valid`.
+    pub violations: Vec<SchemaViolation>,
+}
+
+impl SchemaReport {
+    /// A passing report with no violations.
+    #[must_use]
+    pub fn valid() -> Self {
+        Self {
+            valid: true,
+            violations: Vec::new(),
+        }
+    }
+}
+
+/// Errors that prevent a validation from *running* (distinct from the document
+/// being invalid, which is a [`SchemaReport`] with `valid == false`).
+#[derive(Debug, thiserror::Error)]
+pub enum SchemaError {
+    /// The `xmllint` binary was not found on `PATH`. The harness fails loudly
+    /// rather than skipping validation silently (Spec 02 §5).
+    #[error(
+        "xmllint (libxml2) not found on PATH — install libxml2-utils; schema \
+         validation must not be silently skipped"
+    )]
+    XmllintNotFound,
+    /// Spawning or running `xmllint` failed for an environmental reason.
+    #[error("failed to run xmllint: {0}")]
+    Spawn(#[source] std::io::Error),
+    /// Reading/writing the candidate or a temp file failed.
+    #[error("schema validation I/O error: {0}")]
+    Io(#[source] std::io::Error),
+    /// `xmllint` exited with an unexpected status (neither valid nor the
+    /// well-defined "invalid document" code), with its captured stderr.
+    #[error("xmllint exited unexpectedly (code {code:?}): {stderr}")]
+    Unexpected {
+        /// The process exit code, if any.
+        code: Option<i32>,
+        /// Captured stderr for diagnosis.
+        stderr: String,
+    },
+}
+
+/// Validates serialized XML against a schema. Backend-agnostic so a pure-Rust
+/// validator can later replace the libxml2 one without changing consumers.
+pub trait SchemaValidator {
+    /// Validates the XML file at `xml` against `schema` (of language `kind`).
+    ///
+    /// Returns `Ok(report)` whether or not the document is valid — an invalid
+    /// document is `report.valid == false` with [`SchemaViolation`]s, not an
+    /// `Err`. `Err` is reserved for failures that prevent validation from
+    /// running (see [`SchemaError`]).
+    fn validate_file(
+        &self,
+        xml: &Path,
+        schema: &Path,
+        kind: SchemaKind,
+    ) -> Result<SchemaReport, SchemaError>;
+
+    /// Validates in-memory XML `bytes` against `schema`. The default impl writes
+    /// the bytes to a temp file and delegates to [`Self::validate_file`].
+    fn validate_bytes(
+        &self,
+        bytes: &[u8],
+        schema: &Path,
+        kind: SchemaKind,
+    ) -> Result<SchemaReport, SchemaError> {
+        let dir = tempfile::tempdir().map_err(SchemaError::Io)?;
+        let path = dir.path().join("candidate.xml");
+        std::fs::write(&path, bytes).map_err(SchemaError::Io)?;
+        self.validate_file(&path, schema, kind)
+    }
+}
diff --git a/appthere-conformance/src/schema/xmllint.rs b/appthere-conformance/src/schema/xmllint.rs
new file mode 100644
index 00000000..70249562
--- /dev/null
+++ b/appthere-conformance/src/schema/xmllint.rs
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! `libxml2` (`xmllint`) backend for [`SchemaValidator`](super::SchemaValidator).
+//!
+//! Shells to `xmllint --noout {--schema|--relaxng} <schema> <xml>` and maps the
+//! exit code + stderr to a [`SchemaReport`]. A pure-Rust XSD/RNG validator is
+//! scarce, so this is the pragmatic shipping backend; the trait keeps consumers
+//! insulated from it (Spec 02 §5).
+
+use std::path::Path;
+use std::process::Command;
+
+use super::{SchemaError, SchemaKind, SchemaReport, SchemaValidator, SchemaViolation};
+
+/// Exit codes for which `xmllint` reports a *document* problem (not-well-formed
+/// or schema-invalid) rather than a harness/schema-setup failure. Anything else
+/// nonzero is surfaced as [`SchemaError::Unexpected`].
+const DOCUMENT_INVALID_CODES: &[i32] = &[1, 3, 4];
+
+/// A [`SchemaValidator`] backed by the `xmllint` command-line tool.
+#[derive(Clone, Debug)]
+pub struct XmllintValidator {
+    program: String,
+}
+
+impl XmllintValidator {
+    /// Creates a validator, verifying `xmllint` is runnable. Returns
+    /// [`SchemaError::XmllintNotFound`] if it is absent — the harness fails
+    /// loudly rather than skipping validation.
+    pub fn new() -> Result<Self, SchemaError> {
+        Self::with_program("xmllint")
+    }
+
+    /// Like [`Self::new`] but with an explicit binary name/path (for testing or
+    /// a non-standard install).
+    pub fn with_program(program: impl Into<String>) -> Result<Self, SchemaError> {
+        let program = program.into();
+        match Command::new(&program).arg("--version").output() {
+            Ok(out) if out.status.success() => Ok(Self { program }),
+            Ok(out) => Err(SchemaError::Unexpected {
+                code: out.status.code(),
+                stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
+            }),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Err(SchemaError::XmllintNotFound),
+            Err(e) => Err(SchemaError::Spawn(e)),
+        }
+    }
+
+    /// Whether `xmllint` is available on `PATH`.
+    #[must_use]
+    pub fn is_available() -> bool {
+        Self::new().is_ok()
+    }
+}
+
+impl SchemaValidator for XmllintValidator {
+    fn validate_file(
+        &self,
+        xml: &Path,
+        schema: &Path,
+        kind: SchemaKind,
+    ) -> Result<SchemaReport, SchemaError> {
+        let output = Command::new(&self.program)
+            .arg("--noout")
+            .arg(kind.xmllint_flag())
+            .arg(schema)
+            .arg(xml)
+            .output()
+            .map_err(|e| {
+                if e.kind() == std::io::ErrorKind::NotFound {
+                    SchemaError::XmllintNotFound
+                } else {
+                    SchemaError::Spawn(e)
+                }
+            })?;
+
+        if output.status.success() {
+            return Ok(SchemaReport::valid());
+        }
+
+        let stderr = String::from_utf8_lossy(&output.stderr);
+        let code = output.status.code();
+        if !code.is_some_and(|c| DOCUMENT_INVALID_CODES.contains(&c)) {
+            return Err(SchemaError::Unexpected {
+                code,
+                stderr: stderr.into_owned(),
+            });
+        }
+
+        let violations = parse_violations(&stderr, &xml.to_string_lossy());
+        Ok(SchemaReport {
+            valid: false,
+            violations: if violations.is_empty() {
+                // Nonzero exit with no parseable lines — still a failure.
+                vec![SchemaViolation {
+                    line: None,
+                    message: stderr.trim().to_string(),
+                }]
+            } else {
+                violations
+            },
+        })
+    }
+}
+
+/// Parses `xmllint` stderr into [`SchemaViolation`]s. Error lines are prefixed
+/// with `<xml-path>:<line>:`; continuation lines (no such prefix) extend the
+/// previous message; the trailing `<xml-path> fails to validate` summary and
+/// blank lines are dropped.
+fn parse_violations(stderr: &str, xml_path: &str) -> Vec<SchemaViolation> {
+    let prefix = format!("{xml_path}:");
+    let mut out: Vec<SchemaViolation> = Vec::new();
+    for raw in stderr.lines() {
+        let line = raw.trim_end();
+        if line.is_empty() || line == format!("{xml_path} fails to validate") {
+            continue;
+        }
+        if let Some(rest) = line.strip_prefix(&prefix) {
+            // rest = "<line>: <message>"
+            let (lineno, message) = match rest.split_once(':') {
+                Some((n, msg)) => (n.trim().parse::<u32>().ok(), msg.trim().to_string()),
+                None => (None, rest.trim().to_string()),
+            };
+            out.push(SchemaViolation {
+                line: lineno,
+                message,
+            });
+        } else if let Some(last) = out.last_mut() {
+            last.message.push(' ');
+            last.message.push_str(line.trim());
+        } else {
+            out.push(SchemaViolation {
+                line: None,
+                message: line.trim().to_string(),
+            });
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+#[path = "xmllint_tests.rs"]
+mod tests;
diff --git a/appthere-conformance/src/schema/xmllint_tests.rs b/appthere-conformance/src/schema/xmllint_tests.rs
new file mode 100644
index 00000000..87e20234
--- /dev/null
+++ b/appthere-conformance/src/schema/xmllint_tests.rs
@@ -0,0 +1,119 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use std::path::Path;
+
+use super::super::{SchemaKind, SchemaValidator};
+use super::XmllintValidator;
+
+const NOTE_XSD: &str = r#"<?xml version="1.0"?>
+<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
+  <xs:element name="note" type="xs:string"/>
+</xs:schema>
+"#;
+
+const NOTE_RNG: &str = r#"<?xml version="1.0"?>
+<element name="note" xmlns="http://relaxng.org/ns/structure/1.0">
+  <text/>
+</element>
+"#;
+
+/// Writes `content` to `dir/name` and returns the path.
+fn write(dir: &Path, name: &str, content: &str) -> std::path::PathBuf {
+    let p = dir.join(name);
+    std::fs::write(&p, content).expect("write fixture");
+    p
+}
+
+/// Skips the test (returning the validator) only when `xmllint` is present;
+/// otherwise prints a notice and returns `None`.
+fn validator_or_skip(test: &str) -> Option<XmllintValidator> {
+    match XmllintValidator::new() {
+        Ok(v) => Some(v),
+        Err(_) => {
+            eprintln!("skip {test}: xmllint not available");
+            None
+        }
+    }
+}
+
+#[test]
+fn missing_binary_fails_loudly() {
+    // No xmllint needed: an absent binary must error, never silently pass.
+    let err = XmllintValidator::with_program("appthere-conformance-no-such-xmllint")
+        .expect_err("absent binary must error");
+    assert!(
+        matches!(err, super::super::SchemaError::XmllintNotFound),
+        "expected XmllintNotFound, got {err:?}"
+    );
+}
+
+#[test]
+fn is_available_is_callable() {
+    // Exercises the detection path; the value depends on the environment.
+    let _ = XmllintValidator::is_available();
+}
+
+#[test]
+fn valid_document_passes_xsd() {
+    let Some(v) = validator_or_skip("valid_document_passes_xsd") else {
+        return;
+    };
+    let dir = tempfile::tempdir().unwrap();
+    let xsd = write(dir.path(), "note.xsd", NOTE_XSD);
+    let xml = write(dir.path(), "good.xml", "<note>hello</note>\n");
+    let report = v.validate_file(&xml, &xsd, SchemaKind::Xsd).unwrap();
+    assert!(report.valid, "expected valid, got {report:?}");
+    assert!(report.violations.is_empty());
+}
+
+#[test]
+fn invalid_document_fails_with_located_violation() {
+    let Some(v) = validator_or_skip("invalid_document_fails_with_located_violation") else {
+        return;
+    };
+    let dir = tempfile::tempdir().unwrap();
+    let xsd = write(dir.path(), "note.xsd", NOTE_XSD);
+    let xml = write(dir.path(), "bad.xml", "<wrong>hello</wrong>\n");
+    let report = v.validate_file(&xml, &xsd, SchemaKind::Xsd).unwrap();
+    assert!(!report.valid, "expected invalid");
+    assert!(
+        !report.violations.is_empty(),
+        "expected at least one violation"
+    );
+    // xmllint locates the offending element on line 1.
+    assert_eq!(report.violations[0].line, Some(1));
+    assert!(
+        report.violations[0]
+            .message
+            .to_lowercase()
+            .contains("wrong")
+    );
+}
+
+#[test]
+fn valid_document_passes_relaxng() {
+    let Some(v) = validator_or_skip("valid_document_passes_relaxng") else {
+        return;
+    };
+    let dir = tempfile::tempdir().unwrap();
+    let rng = write(dir.path(), "note.rng", NOTE_RNG);
+    let xml = write(dir.path(), "good.xml", "<note>hello</note>\n");
+    let report = v.validate_file(&xml, &rng, SchemaKind::RelaxNg).unwrap();
+    assert!(report.valid, "expected valid, got {report:?}");
+}
+
+#[test]
+fn validate_bytes_writes_and_validates() {
+    let Some(v) = validator_or_skip("validate_bytes_writes_and_validates") else {
+        return;
+    };
+    let dir = tempfile::tempdir().unwrap();
+    let xsd = write(dir.path(), "note.xsd", NOTE_XSD);
+    let good = v
+        .validate_bytes(b"<note>hi</note>", &xsd, SchemaKind::Xsd)
+        .unwrap();
+    assert!(good.valid);
+    let bad = v.validate_bytes(b"<nope/>", &xsd, SchemaKind::Xsd).unwrap();
+    assert!(!bad.valid);
+}
diff --git a/appthere-conformance/src/sheet/mod.rs b/appthere-conformance/src/sheet/mod.rs
new file mode 100644
index 00000000..48156f16
--- /dev/null
+++ b/appthere-conformance/src/sheet/mod.rs
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Round-trip canonicalization for the spreadsheet model
+//! (`loki_sheet_model::Workbook`), feature `sheet-model`.
+//!
+//! Implements [`NormalizedModel`](crate::roundtrip::NormalizedModel) for
+//! `Workbook`, so the round-trip axis works on spreadsheets the same way the
+//! [`model`](crate::model) adapter does for word-processing documents. The
+//! canonical form is an order-stable sequence of `(path, value)` entries
+//! capturing the semantically significant content — workbook metadata, each
+//! sheet's name, every populated cell's value / formula / style, and custom
+//! column widths. Cells and widths live in `HashMap`s, so the keys are **sorted**
+//! before emission to keep the order deterministic;
+//! [`crate::roundtrip::first_divergence`] then pinpoints the first loss with a
+//! `sheet0000/r0001c0002/…` path.
+
+use loki_sheet_model::workbook::{Cell, CellStyle, Workbook};
+
+use crate::roundtrip::{CanonicalEntry, NormalizedModel};
+
+impl NormalizedModel for Workbook {
+    fn canonical(&self) -> Vec<CanonicalEntry> {
+        canonicalize_workbook(self)
+    }
+}
+
+/// Produces the canonical `(path, value)` form of `wb` (see the module docs).
+#[must_use]
+pub fn canonicalize_workbook(wb: &Workbook) -> Vec<CanonicalEntry> {
+    let mut out = Vec::new();
+    if let Some(t) = &wb.meta.title {
+        push(&mut out, "meta/title", t.clone());
+    }
+    if let Some(c) = &wb.meta.creator {
+        push(&mut out, "meta/creator", c.clone());
+    }
+    for (si, sheet) in wb.sheets.iter().enumerate() {
+        let sp = format!("sheet{si:04}");
+        push(&mut out, format!("{sp}/name"), sheet.name.clone());
+
+        // Cells are keyed by (row, col) in a HashMap — sort for a stable order.
+        let mut cells: Vec<_> = sheet.cells.iter().collect();
+        cells.sort_by(|a, b| a.0.cmp(b.0));
+        for (&(r, c), cell) in cells {
+            walk_cell(cell, &format!("{sp}/r{r:04}c{c:04}"), &mut out);
+        }
+
+        // Custom column widths, likewise sorted by column index.
+        let mut widths: Vec<_> = sheet.column_widths.iter().collect();
+        widths.sort_by(|a, b| a.0.cmp(b.0));
+        for (&col, w) in widths {
+            push(&mut out, format!("{sp}/col{col:04}/width"), format!("{w}"));
+        }
+    }
+    out
+}
+
+fn walk_cell(cell: &Cell, path: &str, out: &mut Vec<CanonicalEntry>) {
+    push(out, format!("{path}/value"), cell.value.clone());
+    if let Some(f) = &cell.formula {
+        push(out, format!("{path}/formula"), f.clone());
+    }
+    if let Some(s) = &cell.style {
+        push(out, format!("{path}/style"), style_summary(s));
+    }
+}
+
+/// A compact, stable serialization of a cell's style — only the set flags, in a
+/// fixed order, so dropping any one changes the string and the differ catches it.
+fn style_summary(s: &CellStyle) -> String {
+    let mut parts: Vec<String> = Vec::new();
+    if s.bold {
+        parts.push("bold".to_string());
+    }
+    if s.italic {
+        parts.push("italic".to_string());
+    }
+    if s.underline {
+        parts.push("underline".to_string());
+    }
+    parts.push(format!("align={}", s.align.as_str()));
+    parts.push(format!("numfmt={}", s.num_format.as_str()));
+    parts.join(";")
+}
+
+fn push(out: &mut Vec<CanonicalEntry>, path: impl Into<String>, value: impl Into<String>) {
+    out.push(CanonicalEntry::new(path, value));
+}
+
+#[cfg(test)]
+#[path = "sheet_tests.rs"]
+mod tests;
diff --git a/appthere-conformance/src/sheet/sheet_tests.rs b/appthere-conformance/src/sheet/sheet_tests.rs
new file mode 100644
index 00000000..e0f3123d
--- /dev/null
+++ b/appthere-conformance/src/sheet/sheet_tests.rs
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use loki_sheet_model::workbook::{CellStyle, Workbook, Worksheet};
+
+use crate::roundtrip::diff_models;
+
+/// A workbook with a single sheet whose `(row, col)` cells carry the given
+/// `(value, formula)` pairs.
+fn wb(cells: &[((u32, u32), &str, Option<&str>)]) -> Workbook {
+    let mut sheet = Worksheet::new("Sheet1");
+    for &((r, c), value, formula) in cells {
+        let cell = sheet.get_cell_mut(r, c);
+        cell.value = value.to_string();
+        cell.formula = formula.map(str::to_string);
+    }
+    let mut w = Workbook::new();
+    w.sheets = vec![sheet];
+    w
+}
+
+#[test]
+fn identical_workbooks_round_trip_clean() {
+    let a = wb(&[((0, 0), "1", None), ((0, 1), "2", None)]);
+    assert_eq!(diff_models(&a, &a.clone()), None);
+}
+
+#[test]
+fn dropped_cell_value_is_caught_with_a_coord_path() {
+    let a = wb(&[((0, 0), "hello", None), ((2, 3), "world", None)]);
+    let b = wb(&[((0, 0), "hello", None), ((2, 3), "", None)]);
+
+    let d = diff_models(&a, &b).expect("changed cell value must be caught");
+    assert!(d.path.ends_with("/r0002c0003/value"), "path = {}", d.path);
+    assert_eq!(d.left.as_deref(), Some("world"));
+    assert_eq!(d.right.as_deref(), Some(""));
+}
+
+#[test]
+fn dropped_formula_is_caught() {
+    let a = wb(&[((0, 0), "3", Some("=1+2"))]);
+    let b = wb(&[((0, 0), "3", None)]);
+
+    let d = diff_models(&a, &b).expect("dropped formula must be caught");
+    assert!(d.path.ends_with("/formula"), "path = {}", d.path);
+    assert_eq!(d.left.as_deref(), Some("=1+2"));
+    assert!(d.right.is_none(), "right should lack the formula entry");
+}
+
+#[test]
+fn lost_cell_style_is_caught() {
+    let mut a = wb(&[((0, 0), "x", None)]);
+    a.sheets[0].get_cell_mut(0, 0).style = Some(CellStyle {
+        bold: true,
+        ..Default::default()
+    });
+    let b = wb(&[((0, 0), "x", None)]);
+
+    let d = diff_models(&a, &b).expect("lost style must be caught");
+    assert!(d.path.ends_with("/style"), "path = {}", d.path);
+    assert!(d.left.as_deref().unwrap_or_default().contains("bold"));
+    assert!(d.right.is_none());
+}
+
+#[test]
+fn renamed_sheet_is_caught() {
+    let a = wb(&[((0, 0), "x", None)]);
+    let mut b = wb(&[((0, 0), "x", None)]);
+    b.sheets[0].name = "Renamed".to_string();
+
+    let d = diff_models(&a, &b).expect("renamed sheet must be caught");
+    assert!(d.path.ends_with("/name"), "path = {}", d.path);
+    assert_eq!(d.left.as_deref(), Some("Sheet1"));
+    assert_eq!(d.right.as_deref(), Some("Renamed"));
+}
diff --git a/appthere-ui/src/components/icons.rs b/appthere-ui/src/components/icons.rs
index 67eb2678..c80229bd 100644
--- a/appthere-ui/src/components/icons.rs
+++ b/appthere-ui/src/components/icons.rs
@@ -67,6 +67,24 @@ pub const LUCIDE_ALIGN_JUSTIFY: &str = "M3 6h18M3 12h18M3 18h18";
 /// Lucide `pilcrow` — paragraph mark (¶).
 pub const LUCIDE_PILCROW: &str = "M13 4v16M17 4v16M8 4h4a4 4 0 0 1 0 8H8";
 
+/// Lucide `link` — two interlocking chain links (two subpaths in one `d`).
+pub const LUCIDE_LINK: &str =
+    "M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71";
+
+/// Lucide `image` — framed picture with a sun and a mountain (subpaths in one
+/// `d`; the circle is approximated with two arc halves).
+pub const LUCIDE_IMAGE: &str =
+    "M19 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2V5a2 2 0 0 0-2-2zM10 9a1.5 1.5 0 1 1-3 0 1.5 1.5 0 0 1 3 0zM21 15l-5-5L5 21";
+
+/// Lucide `table` — a bordered grid (outer frame plus one mid horizontal and
+/// one mid vertical divider). Used for Insert → Table.
+pub const LUCIDE_TABLE: &str =
+    "M12 3v18M3 9h18M3 15h18M5 3h14a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2z";
+
+/// Lucide `superscript`-style reference mark reused for Insert → Footnote — a
+/// down-step baseline with a raised reference tick, evoking a footnote marker.
+pub const LUCIDE_FOOTNOTE: &str = "M4 5h6M4 5v10a3 3 0 0 0 6 0M16 5v6m0-6h4m-4 0-1 1";
+
 // ── AtIcon component ──────────────────────────────────────────────────────────
 
 /// Renders a single Lucide SVG icon.
diff --git a/appthere-ui/src/components/mod.rs b/appthere-ui/src/components/mod.rs
index 813e44ec..2b822cc1 100644
--- a/appthere-ui/src/components/mod.rs
+++ b/appthere-ui/src/components/mod.rs
@@ -8,6 +8,7 @@
 pub mod document_tab;
 pub mod home_tab;
 pub mod icons;
+pub mod panel_host;
 pub mod platform;
 pub mod ribbon;
 pub mod status_bar;
@@ -16,6 +17,7 @@ pub mod title_bar;
 
 pub use document_tab::{AtDocumentTab, AtDocumentTabProps};
 pub use home_tab::{AtHomeTab, AtHomeTabProps, BuiltinTemplate, RecentDocument};
+pub use panel_host::{AtPanelHost, AtPanelHostProps, PanelPosture};
 pub use platform::Platform;
 pub use ribbon::{AtRibbon, AtRibbonGroup, AtRibbonGroupProps, RibbonTabDesc, RibbonTabIndex};
 pub use status_bar::{AtStatusBar, AtStatusBarProps};
diff --git a/appthere-ui/src/components/panel_host.rs b/appthere-ui/src/components/panel_host.rs
new file mode 100644
index 00000000..50581195
--- /dev/null
+++ b/appthere-ui/src/components/panel_host.rs
@@ -0,0 +1,177 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! `AtPanelHost` — the sanctioned host for a conditionally-mounted panel
+//! (Spec 05 §10 / ADR-0013).
+//!
+//! # The pattern
+//!
+//! A panel shown behind a condition must **not** be a plain function called
+//! inside `if cond { panel(..) }` with an early `return rsx!{}`: that body has no
+//! component identity, so it cannot host a hook — including
+//! [`use_breakpoint`](crate::responsive::use_breakpoint) — and threading a
+//! `compact` flag down from the parent grows the parent (the `editor_inner.rs`
+//! ceiling pressure that deferred Spec 03's R-13g).
+//!
+//! Instead, a panel is a `#[component]` mounted **at the boundary**:
+//! ```rust,ignore
+//! {open().then(|| rsx! {
+//!     AtPanelHost { title: fl!("styles-title"), on_close: move |_| open.set(false),
+//!         StyleInspector { /* … */ }
+//!     }
+//! })}
+//! ```
+//! The component owns its hook scope (Dioxus manages it across mount/unmount), so
+//! it reads the resilient `use_breakpoint()` directly and adapts posture with no
+//! prop threading and no growth of the mounting parent.
+//!
+//! `AtPanelHost` is that boundary: it renders a titled, closable container and
+//! picks its posture from the size class ([`PanelPosture::for_breakpoint`]) — a
+//! full-width touch-first sheet at Compact, a bounded side panel at
+//! Medium/Expanded. Elevation is token border/background (no `box-shadow`); it
+//! lives in flow (no `position: fixed`) per the Blitz constraints. Spec 05's
+//! family panels mount their inspector inside it, so each is born able to read
+//! the breakpoint.
+
+use dioxus::prelude::*;
+
+use crate::responsive::{use_breakpoint, Breakpoint};
+use crate::tokens::colors::{COLOR_BORDER_CHROME, COLOR_SURFACE_1, COLOR_TEXT_ON_CHROME};
+use crate::tokens::layout::PANEL_SIDE_WIDTH_PX;
+use crate::tokens::spacing::{RADIUS_MD, SPACE_2, SPACE_3, SPACE_4, TOUCH_MIN};
+use crate::tokens::typography::{FONT_FAMILY_UI, FONT_SIZE_MD, FONT_WEIGHT_SEMIBOLD};
+
+/// Responsive posture for a hosted panel, derived **purely** from the size class
+/// so it is testable without a real window (Spec 03 D1).
+///
+/// At Compact the panel is a full-width, touch-first sheet (no room beside the
+/// document); at Medium/Expanded it is a bounded side panel.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct PanelPosture {
+    /// Fill the available width (a Compact sheet) rather than sit at [`width_px`].
+    ///
+    /// [`width_px`]: PanelPosture::width_px
+    pub full_width: bool,
+    /// Bounded panel width (logical px) when not [`full_width`]. Ignored when
+    /// `full_width` is `true`.
+    ///
+    /// [`full_width`]: PanelPosture::full_width
+    pub width_px: f32,
+}
+
+impl PanelPosture {
+    /// The posture for a size class.
+    #[must_use]
+    pub fn for_breakpoint(bp: Breakpoint) -> Self {
+        if bp.is_compact() {
+            Self {
+                full_width: true,
+                width_px: PANEL_SIDE_WIDTH_PX,
+            }
+        } else {
+            Self {
+                full_width: false,
+                width_px: PANEL_SIDE_WIDTH_PX,
+            }
+        }
+    }
+
+    /// The CSS `width` value this posture resolves to.
+    #[must_use]
+    pub fn css_width(self) -> String {
+        if self.full_width {
+            "100%".to_string()
+        } else {
+            format!("{}px", self.width_px)
+        }
+    }
+}
+
+/// A responsive host for a conditionally-mounted panel — the sanctioned
+/// conditional-panel pattern (see the module docs and ADR-0013).
+///
+/// Mount it at a boundary (`{open().then(|| rsx! { AtPanelHost { .. } })}`); it
+/// reads [`use_breakpoint`](crate::responsive::use_breakpoint) itself and adapts
+/// posture via [`PanelPosture`] without any `compact` flag from the parent.
+///
+/// # Touch target
+///
+/// The close control is **44×44 logical px minimum** (WCAG 2.5.8, `TOUCH_MIN`).
+#[component]
+pub fn AtPanelHost(props: AtPanelHostProps) -> Element {
+    let posture = PanelPosture::for_breakpoint(use_breakpoint());
+
+    rsx! {
+        section {
+            role: "dialog",
+            "aria-label": props.title.clone(),
+            style: format!(
+                "display: flex; flex-direction: column; box-sizing: border-box; \
+                 width: {width}; background: {bg}; border: 1px solid {border}; \
+                 border-radius: {radius}px; font-family: {font};",
+                width  = posture.css_width(),
+                bg     = COLOR_SURFACE_1,
+                border = COLOR_BORDER_CHROME,
+                radius = RADIUS_MD,
+                font   = FONT_FAMILY_UI,
+            ),
+
+            // ── Header: title + close (TOUCH_MIN target) ──────────────────────
+            div {
+                style: format!(
+                    "display: flex; align-items: center; gap: {gap}px; \
+                     padding: {pv}px {ph}px; border-bottom: 1px solid {border};",
+                    gap    = SPACE_2,
+                    pv     = SPACE_2,
+                    ph     = SPACE_4,
+                    border = COLOR_BORDER_CHROME,
+                ),
+                span {
+                    style: format!(
+                        "flex: 1; color: {fg}; font-size: {size}px; font-weight: {weight};",
+                        fg     = COLOR_TEXT_ON_CHROME,
+                        size   = FONT_SIZE_MD,
+                        weight = FONT_WEIGHT_SEMIBOLD,
+                    ),
+                    "{props.title}"
+                }
+                button {
+                    "aria-label": props.close_aria_label.clone(),
+                    style: format!(
+                        "min-width: {t}px; min-height: {t}px; background: transparent; \
+                         border: none; border-radius: {radius}px; color: {fg}; \
+                         font-size: {size}px; cursor: pointer;",
+                        t      = TOUCH_MIN,
+                        radius = RADIUS_MD,
+                        fg     = COLOR_TEXT_ON_CHROME,
+                        size   = FONT_SIZE_MD,
+                    ),
+                    onclick: move |_| props.on_close.call(()),
+                    "✕"
+                }
+            }
+
+            // ── Body ──────────────────────────────────────────────────────────
+            div {
+                style: format!("padding: {p}px; overflow-y: auto;", p = SPACE_3),
+                {props.children}
+            }
+        }
+    }
+}
+
+/// Props for [`AtPanelHost`].
+#[derive(Props, Clone, PartialEq)]
+pub struct AtPanelHostProps {
+    /// Localized panel title shown in the header.
+    pub title: String,
+    /// Aria label for the close control (localized).
+    pub close_aria_label: String,
+    /// Invoked when the user activates the close control.
+    pub on_close: EventHandler<()>,
+    /// Panel body.
+    pub children: Element,
+}
+
+#[cfg(test)]
+#[path = "panel_host_tests.rs"]
+mod tests;
diff --git a/appthere-ui/src/components/panel_host_tests.rs b/appthere-ui/src/components/panel_host_tests.rs
new file mode 100644
index 00000000..8f7be411
--- /dev/null
+++ b/appthere-ui/src/components/panel_host_tests.rs
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! `AtPanelHost` posture (Spec 05 M3 / ADR-0013): the breakpoint-driven posture
+//! is a pure decision, testable without a real window (Spec 03 D1).
+
+use super::*;
+use crate::tokens::layout::PANEL_SIDE_WIDTH_PX;
+
+/// Resolve every size class through the posture decision (a runtime call, so the
+/// assertions below are not constant-folded).
+fn posture(bp: Breakpoint) -> PanelPosture {
+    PanelPosture::for_breakpoint(bp)
+}
+
+#[test]
+fn compact_is_a_full_width_sheet() {
+    // Compact has no room beside the document → full-width sheet.
+    assert_eq!(posture(Breakpoint::Compact).css_width(), "100%");
+}
+
+#[test]
+fn medium_and_expanded_are_bounded_side_panels() {
+    let expected = format!("{PANEL_SIDE_WIDTH_PX}px");
+    assert_eq!(posture(Breakpoint::Medium).css_width(), expected);
+    assert_eq!(posture(Breakpoint::Expanded).css_width(), expected);
+    assert_eq!(posture(Breakpoint::Expanded).width_px, PANEL_SIDE_WIDTH_PX);
+}
+
+#[test]
+fn posture_changes_only_on_the_compact_boundary() {
+    // Medium and Expanded share the bounded posture; only Compact differs — the
+    // host re-lays-out on the class boundary, not per pixel.
+    assert_eq!(posture(Breakpoint::Medium), posture(Breakpoint::Expanded));
+    assert_ne!(posture(Breakpoint::Compact), posture(Breakpoint::Expanded));
+}
diff --git a/appthere-ui/src/components/ribbon/group.rs b/appthere-ui/src/components/ribbon/group.rs
index a53c52c7..6f7e16a0 100644
--- a/appthere-ui/src/components/ribbon/group.rs
+++ b/appthere-ui/src/components/ribbon/group.rs
@@ -38,9 +38,11 @@ pub fn AtRibbonGroup(
         div {
             role: "group",
             aria_label: aria_label,
-            // COMPAT(dioxus-native): position: absolute is unsupported in Blitz.
             // Group label rendered as a flex column child below the buttons
-            // rather than absolutely positioned at the group bottom.
+            // rather than absolutely positioned at the group bottom. (Block-level
+            // position: absolute is now confirmed working in Blitz — see
+            // CLAUDE.md "Confirmed CSS properties" — so this in-flow layout is a
+            // deliberate choice, no longer a Blitz limitation.)
             style: format!(
                 "display: flex; flex-direction: column; align-items: center; \
                  height: 100%; padding: 0 {p}px; \
diff --git a/appthere-ui/src/components/status_bar.rs b/appthere-ui/src/components/status_bar.rs
index 6c80b6ef..2039f82b 100644
--- a/appthere-ui/src/components/status_bar.rs
+++ b/appthere-ui/src/components/status_bar.rs
@@ -7,9 +7,10 @@
 
 use dioxus::prelude::*;
 
+use crate::responsive::use_breakpoint;
 use crate::tokens::colors::{
-    COLOR_BORDER_CHROME, COLOR_SURFACE_3, COLOR_SURFACE_CHROME, COLOR_TEXT_ACCENT,
-    COLOR_TEXT_ON_CHROME_SECONDARY,
+    COLOR_BORDER_CHROME, COLOR_CONTEXTUAL_TAB, COLOR_SURFACE_3, COLOR_SURFACE_CHROME,
+    COLOR_TEXT_ACCENT, COLOR_TEXT_ON_CHROME_SECONDARY,
 };
 use crate::tokens::layout::STATUS_BAR_HEIGHT;
 use crate::tokens::spacing::{RADIUS_SM, SPACE_1, SPACE_2, SPACE_4};
@@ -40,7 +41,17 @@ pub fn AtStatusBar(props: AtStatusBarProps) -> Element {
     } else {
         COLOR_SURFACE_3
     };
+    let mut notice_hovered = use_signal(|| false);
+    let notice_bg = if notice_hovered() {
+        "#444444"
+    } else {
+        COLOR_SURFACE_3
+    };
     let show_view_toggle = !props.view_mode_label.is_empty();
+    let show_notice = !props.notice_label.is_empty();
+    // Compact (phone-width): drop the secondary stats (word count, language)
+    // so the essential page / notice / view-mode / zoom items don't crowd.
+    let compact = use_breakpoint().is_compact();
 
     rsx! {
         div {
@@ -75,8 +86,9 @@ pub fn AtStatusBar(props: AtStatusBarProps) -> Element {
                 }
             }
 
-            // Word count label (e.g. "1,847 words"). Hidden when empty.
-            if !props.word_count_label.is_empty() {
+            // Word count label (e.g. "1,847 words"). Hidden when empty or at
+            // Compact width (secondary stat).
+            if !props.word_count_label.is_empty() && !compact {
                 span {
                     style: format!(
                         "font-size: {size}px; color: {fg};",
@@ -87,19 +99,46 @@ pub fn AtStatusBar(props: AtStatusBarProps) -> Element {
                 }
             }
 
+            // Optional status notice chip (e.g. recover a dismissed warning).
+            // Border + background only — no box-shadow (Blitz constraint).
+            if show_notice {
+                button {
+                    "aria-label": props.notice_aria_label.clone(),
+                    style: format!(
+                        "background: {bg}; border: 1px solid {border}; border-radius: {r}px; \
+                         color: {fg}; font-size: {size}px; font-weight: {weight}; \
+                         cursor: pointer; padding: {pv}px {ph}px; flex-shrink: 0;",
+                        bg     = notice_bg,
+                        border = COLOR_CONTEXTUAL_TAB,
+                        r      = RADIUS_SM,
+                        fg     = COLOR_TEXT_ON_CHROME_SECONDARY,
+                        size   = FONT_SIZE_XS,
+                        weight = FONT_WEIGHT_MEDIUM,
+                        pv     = SPACE_1,
+                        ph     = SPACE_2,
+                    ),
+                    onmouseenter: move |_| { notice_hovered.set(true); },
+                    onmouseleave: move |_| { notice_hovered.set(false); },
+                    onclick: move |_| { props.on_notice_click.call(()); },
+                    "⚠ {props.notice_label}"
+                }
+            }
+
             // Flex spacer — pushes right-side content to the far right
             div { style: "flex: 1;" }
 
             // ── Right: language, zoom, collaborators ──────────────────────────
 
-            // Language label (e.g. "English (US)")
-            span {
-                style: format!(
-                    "font-size: {size}px; color: {fg};",
-                    size = FONT_SIZE_XS,
-                    fg   = COLOR_TEXT_ON_CHROME_SECONDARY,
-                ),
-                "{props.language_label}"
+            // Language label (e.g. "English (US)"). Hidden at Compact width.
+            if !compact {
+                span {
+                    style: format!(
+                        "font-size: {size}px; color: {fg};",
+                        size = FONT_SIZE_XS,
+                        fg   = COLOR_TEXT_ON_CHROME_SECONDARY,
+                    ),
+                    "{props.language_label}"
+                }
             }
 
             // View-mode toggle (paginated ⇆ reflowed). Hidden unless a label is
@@ -210,4 +249,23 @@ pub struct AtStatusBarProps {
     /// no-op when not provided.
     #[props(default)]
     pub on_view_mode_click: Callback<()>,
+
+    /// Optional status-notice chip rendered on the left (e.g. the recovery
+    /// affordance for a dismissed font-substitution warning). Empty (the
+    /// default) hides it, so apps that do not use it are unaffected. Generic by
+    /// design — not font-specific.
+    ///
+    /// **Min interactive size: 44×44 logical px (WCAG 2.5.8).** TODO(a11y):
+    /// expand the invisible touch target to `TOUCH_MIN` (shared with the zoom /
+    /// view-mode badges, which carry the same status-bar-height constraint).
+    #[props(default)]
+    pub notice_label: String,
+
+    /// Aria label for the notice chip.
+    #[props(default)]
+    pub notice_aria_label: String,
+
+    /// Callback invoked when the notice chip is clicked.
+    #[props(default)]
+    pub on_notice_click: Callback<()>,
 }
diff --git a/appthere-ui/src/components/title_bar.rs b/appthere-ui/src/components/title_bar.rs
index c3ff078f..971359e6 100644
--- a/appthere-ui/src/components/title_bar.rs
+++ b/appthere-ui/src/components/title_bar.rs
@@ -8,6 +8,7 @@
 use dioxus::prelude::*;
 
 use crate::components::platform::Platform;
+use crate::responsive::use_breakpoint;
 use crate::tokens::colors::{
     COLOR_BORDER_CHROME, COLOR_SURFACE_CHROME, COLOR_TEXT_ACCENT, COLOR_TEXT_ON_CHROME,
     COLOR_TEXT_ON_CHROME_SECONDARY,
@@ -63,6 +64,9 @@ pub fn AtTitleBar(props: AtTitleBarProps) -> Element {
         "transparent"
     };
 
+    // Compact (phone-width): drop redundant chrome so the title isn't crowded.
+    let compact = use_breakpoint().is_compact();
+
     let title_text = match &props.document_title {
         Some(t) if props.is_dirty => format!("• {t}"),
         Some(t) => t.clone(),
@@ -153,8 +157,10 @@ pub fn AtTitleBar(props: AtTitleBarProps) -> Element {
                 }
             }
 
-            // App name in top-right corner when a document is open
-            if props.document_title.is_some() {
+            // App name in top-right corner when a document is open. Hidden at
+            // Compact width — the app icon already identifies the app, and the
+            // narrow title bar needs the space for the document title.
+            if props.document_title.is_some() && !compact {
                 span {
                     style: format!(
                         "font-size: {size}px; font-weight: {weight}; \
diff --git a/appthere-ui/src/lib.rs b/appthere-ui/src/lib.rs
index 2fdbba5a..d86db451 100644
--- a/appthere-ui/src/lib.rs
+++ b/appthere-ui/src/lib.rs
@@ -26,23 +26,29 @@
 #![warn(missing_docs)]
 
 pub mod components;
+pub mod responsive;
 pub mod safe_area;
 pub mod theme;
 pub mod tokens;
 
 pub use components::icons::{
     AtIcon, LUCIDE_ALIGN_CENTER, LUCIDE_ALIGN_JUSTIFY, LUCIDE_ALIGN_LEFT, LUCIDE_ALIGN_RIGHT,
-    LUCIDE_BOLD, LUCIDE_DOWNLOAD, LUCIDE_ITALIC, LUCIDE_LAYOUT_TEMPLATE, LUCIDE_PILCROW,
-    LUCIDE_REDO, LUCIDE_SAVE, LUCIDE_STRIKETHROUGH, LUCIDE_SUBSCRIPT, LUCIDE_SUPERSCRIPT,
-    LUCIDE_UNDERLINE, LUCIDE_UNDO,
+    LUCIDE_BOLD, LUCIDE_DOWNLOAD, LUCIDE_FOOTNOTE, LUCIDE_IMAGE, LUCIDE_ITALIC,
+    LUCIDE_LAYOUT_TEMPLATE, LUCIDE_LINK, LUCIDE_PILCROW, LUCIDE_REDO, LUCIDE_SAVE,
+    LUCIDE_STRIKETHROUGH, LUCIDE_SUBSCRIPT, LUCIDE_SUPERSCRIPT, LUCIDE_TABLE, LUCIDE_UNDERLINE,
+    LUCIDE_UNDO,
 };
 pub use components::ribbon::{
     AtRibbon, AtRibbonGroup, AtRibbonIconButton, AtRibbonSelect, RibbonTabDesc, RibbonTabIndex,
 };
 pub use components::{
-    AtDocumentTab, AtDocumentTabData, AtDocumentTabProps, AtHomeTab, AtHomeTabProps, AtStatusBar,
-    AtStatusBarProps, AtTabBar, AtTabBarProps, AtTitleBar, AtTitleBarProps, BuiltinTemplate,
-    Platform, RecentDocument,
+    AtDocumentTab, AtDocumentTabData, AtDocumentTabProps, AtHomeTab, AtHomeTabProps, AtPanelHost,
+    AtPanelHostProps, AtStatusBar, AtStatusBarProps, AtTabBar, AtTabBarProps, AtTitleBar,
+    AtTitleBarProps, BuiltinTemplate, PanelPosture, Platform, RecentDocument,
+};
+pub use responsive::{
+    page_fits, required_page_width, resolve_page_fit, use_breakpoint, use_provide_responsive,
+    use_responsive, use_viewport, AtResponsiveContext, Breakpoint, PageFit, Viewport, DEFAULT_DPI,
 };
 pub use safe_area::{set_safe_area_insets, update_safe_area_insets, use_safe_area, SafeAreaInsets};
 pub use theme::{use_theme, AtThemeContext, ThemeVariant};
diff --git a/appthere-ui/src/responsive/breakpoint.rs b/appthere-ui/src/responsive/breakpoint.rs
new file mode 100644
index 00000000..79caff25
--- /dev/null
+++ b/appthere-ui/src/responsive/breakpoint.rs
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Semantic window-size classification (Spec 03 §5).
+
+use crate::tokens::layout::{BREAKPOINT_COMPACT_MAX_PX, BREAKPOINT_EXPANDED_MIN_PX};
+
+/// A semantic window-size class, derived from the measured viewport width.
+///
+/// Breakpoints are **size classes, not device names** (Spec 03 D4): two windows
+/// of equal width behave identically regardless of hardware, so tablets,
+/// split-screen windows, and large landscape phones classify by width alone. The
+/// variants are ordered `Compact < Medium < Expanded`, so a "`>= Medium`" check
+/// is a plain comparison.
+///
+/// This is the **single source of truth** for any responsive behaviour that must
+/// be testable without a real window (Spec 03 D1) — panel collapse, renderer
+/// posture, chrome density. It is derived state: compute it once from the shared
+/// [`Viewport`](crate::responsive::Viewport) and read it via
+/// [`use_breakpoint`](crate::responsive::use_breakpoint), never re-measure.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum Breakpoint {
+    /// `< 600` px — single column, touch-first chrome, non-paginated, stacked
+    /// panels.
+    Compact,
+    /// `600–1024` px — transitional; page-fit decides the renderer, panels may
+    /// overlay.
+    Medium,
+    /// `>= 1024` px — paginated, full chrome, side-by-side panels.
+    Expanded,
+}
+
+impl Breakpoint {
+    /// Classifies a measured width (CSS px) into a size class.
+    ///
+    /// An unmeasured / zero width classifies as [`Breakpoint::Compact`]
+    /// (mobile-first; the first measured frame corrects it).
+    #[must_use]
+    pub fn from_width(width_px: f32) -> Self {
+        if width_px < BREAKPOINT_COMPACT_MAX_PX {
+            Breakpoint::Compact
+        } else if width_px < BREAKPOINT_EXPANDED_MIN_PX {
+            Breakpoint::Medium
+        } else {
+            Breakpoint::Expanded
+        }
+    }
+
+    /// `true` for [`Breakpoint::Compact`].
+    #[must_use]
+    pub fn is_compact(self) -> bool {
+        self == Breakpoint::Compact
+    }
+
+    /// `true` for [`Breakpoint::Medium`].
+    #[must_use]
+    pub fn is_medium(self) -> bool {
+        self == Breakpoint::Medium
+    }
+
+    /// `true` for [`Breakpoint::Expanded`].
+    #[must_use]
+    pub fn is_expanded(self) -> bool {
+        self == Breakpoint::Expanded
+    }
+
+    /// `true` where chrome should adopt a touch-first posture (≥44 px targets,
+    /// stacked layouts). Currently the Compact class.
+    #[must_use]
+    pub fn is_touch_first(self) -> bool {
+        self == Breakpoint::Compact
+    }
+}
+
+#[cfg(test)]
+#[path = "breakpoint_tests.rs"]
+mod tests;
diff --git a/appthere-ui/src/responsive/breakpoint_tests.rs b/appthere-ui/src/responsive/breakpoint_tests.rs
new file mode 100644
index 00000000..103f2bc8
--- /dev/null
+++ b/appthere-ui/src/responsive/breakpoint_tests.rs
@@ -0,0 +1,67 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::Breakpoint;
+use crate::tokens::layout::{BREAKPOINT_COMPACT_MAX_PX, BREAKPOINT_EXPANDED_MIN_PX};
+
+// Spec 03 M1 acceptance: a width change produces the correct `Breakpoint` with
+// no real window — pure classification, mirroring the Spec 02 harness style.
+
+#[test]
+fn well_inside_each_band_classifies_correctly() {
+    assert_eq!(Breakpoint::from_width(0.0), Breakpoint::Compact);
+    assert_eq!(Breakpoint::from_width(375.0), Breakpoint::Compact);
+    assert_eq!(Breakpoint::from_width(800.0), Breakpoint::Medium);
+    assert_eq!(Breakpoint::from_width(1440.0), Breakpoint::Expanded);
+}
+
+#[test]
+fn boundaries_are_compact_lower_inclusive_expanded_lower_inclusive() {
+    // Compact is `< 600`; exactly 600 is the first Medium width.
+    assert_eq!(
+        Breakpoint::from_width(BREAKPOINT_COMPACT_MAX_PX - 0.01),
+        Breakpoint::Compact
+    );
+    assert_eq!(
+        Breakpoint::from_width(BREAKPOINT_COMPACT_MAX_PX),
+        Breakpoint::Medium
+    );
+    // Medium is `< 1024`; exactly 1024 is the first Expanded width.
+    assert_eq!(
+        Breakpoint::from_width(BREAKPOINT_EXPANDED_MIN_PX - 0.01),
+        Breakpoint::Medium
+    );
+    assert_eq!(
+        Breakpoint::from_width(BREAKPOINT_EXPANDED_MIN_PX),
+        Breakpoint::Expanded
+    );
+}
+
+#[test]
+fn variants_order_compact_lt_medium_lt_expanded() {
+    // Classify ascending widths and assert the derived classes are monotonic —
+    // exercises the `Ord` derivation through runtime values.
+    let classes: Vec<Breakpoint> = [100.0, 400.0, 700.0, 1100.0, 2000.0]
+        .into_iter()
+        .map(Breakpoint::from_width)
+        .collect();
+    assert!(classes.windows(2).all(|w| w[0] <= w[1]), "{classes:?}");
+    // "at least Medium" is a plain comparison.
+    assert!(Breakpoint::from_width(800.0) >= Breakpoint::Medium);
+    assert!(Breakpoint::from_width(400.0) < Breakpoint::Medium);
+}
+
+#[test]
+fn predicates_match_the_class() {
+    let c = Breakpoint::Compact;
+    assert!(c.is_compact() && !c.is_medium() && !c.is_expanded());
+    assert!(c.is_touch_first());
+
+    let m = Breakpoint::Medium;
+    assert!(m.is_medium() && !m.is_compact() && !m.is_expanded());
+    assert!(!m.is_touch_first());
+
+    let e = Breakpoint::Expanded;
+    assert!(e.is_expanded() && !e.is_compact() && !e.is_medium());
+    assert!(!e.is_touch_first());
+}
diff --git a/appthere-ui/src/responsive/mod.rs b/appthere-ui/src/responsive/mod.rs
new file mode 100644
index 00000000..597111cf
--- /dev/null
+++ b/appthere-ui/src/responsive/mod.rs
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Responsive foundation (Spec 03 M1): the shared [`Viewport`] and its semantic
+//! [`Breakpoint`] classification, plus the context that exposes them to UI
+//! components across the AppThere suite.
+//!
+//! # Single source of truth
+//!
+//! There is exactly one width source: the measured scroll-container width, held
+//! in a `Signal<Viewport>` provided at the application root. Components never
+//! re-measure — they read the *derived* [`Breakpoint`] via [`use_breakpoint`],
+//! which only re-renders them when the size *class* changes, not on every pixel.
+//!
+//! # Wiring
+//!
+//! At the app root, call [`use_provide_responsive`] and feed the measured width
+//! into the returned signal whenever it changes:
+//! ```rust,ignore
+//! let mut responsive = use_provide_responsive();
+//! // …in the scroll/resize handler, from the one measured width:
+//! responsive.set(Viewport::new(measured_client_width_px));
+//! ```
+//! Any descendant then reads:
+//! ```rust,ignore
+//! let bp = use_breakpoint();
+//! if bp.is_compact() { /* stacked, touch-first chrome */ }
+//! ```
+
+mod breakpoint;
+mod page_fit;
+mod viewport;
+
+pub use breakpoint::Breakpoint;
+pub use page_fit::{page_fits, required_page_width, resolve_page_fit, PageFit};
+pub use viewport::{Viewport, DEFAULT_DPI};
+
+use dioxus::prelude::*;
+
+/// Responsive context injected at the application root: the live measured
+/// [`Viewport`] and its memoised [`Breakpoint`].
+///
+/// The `breakpoint` memo only recomputes (and only wakes its readers) when the
+/// derived size *class* changes, so per-pixel width updates do not churn the UI.
+#[derive(Clone, Copy, PartialEq)]
+pub struct AtResponsiveContext {
+    /// The live measured viewport (width + zoom + DPI).
+    pub viewport: Signal<Viewport>,
+    /// The size class derived from `viewport`, memoised on the class boundary.
+    pub breakpoint: Memo<Breakpoint>,
+}
+
+/// Provides the [`AtResponsiveContext`] at the application root and returns the
+/// backing [`Viewport`] signal so the app can push measured widths into it.
+///
+/// Seeds with [`Viewport::default`] (unmeasured → [`Breakpoint::Compact`]); the
+/// first measured frame corrects it. Call once, in the root component.
+pub fn use_provide_responsive() -> Signal<Viewport> {
+    let viewport = use_signal(Viewport::default);
+    let breakpoint = use_memo(move || viewport.read().breakpoint());
+    provide_context(AtResponsiveContext {
+        viewport,
+        breakpoint,
+    });
+    viewport
+}
+
+/// Reads the [`AtResponsiveContext`] injected at the application root.
+///
+/// # Panics
+///
+/// Panics if [`use_provide_responsive`] was not called in an ancestor.
+#[must_use]
+pub fn use_responsive() -> AtResponsiveContext {
+    use_context::<AtResponsiveContext>()
+}
+
+/// Reads the current measured [`Viewport`] from context (reactive).
+#[must_use]
+pub fn use_viewport() -> Viewport {
+    *use_responsive().viewport.read()
+}
+
+/// Reads the current [`Breakpoint`] from context (reactive on the class
+/// boundary only — the common case for responsive components).
+///
+/// **Resilient:** shell components are shared across the suite, but only apps
+/// that called [`use_provide_responsive`] expose the context. Without it this
+/// returns [`Breakpoint::Expanded`] (full chrome) rather than panicking, so an
+/// app that has not wired the responsive context yet keeps its existing,
+/// non-adaptive layout.
+#[must_use]
+pub fn use_breakpoint() -> Breakpoint {
+    match try_consume_context::<AtResponsiveContext>() {
+        Some(ctx) => *ctx.breakpoint.read(),
+        None => Breakpoint::Expanded,
+    }
+}
diff --git a/appthere-ui/src/responsive/page_fit.rs b/appthere-ui/src/responsive/page_fit.rs
new file mode 100644
index 00000000..565abc7c
--- /dev/null
+++ b/appthere-ui/src/responsive/page_fit.rs
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Page-fit renderer decision (Spec 03 M2 / D2).
+//!
+//! The paginated ↔ non-paginated switch follows **content fit, not device
+//! class**: use the paginated renderer when a full page column fits the
+//! viewport at the current zoom, otherwise the reflow renderer to avoid
+//! horizontal scrolling. A large landscape phone that fits a page gets
+//! pagination; a narrow split-screen desktop window that can't gets reflow. The
+//! [`Breakpoint`](crate::responsive::Breakpoint) still informs *chrome* posture
+//! — the *renderer* follows this.
+//!
+//! The decision is **hysteretic**: a window dragged to exactly the boundary must
+//! cross `threshold ± PAGE_FIT_HYSTERESIS_PX` to flip, so it never thrashes.
+//!
+//! All math is in CSS pixels, so it is DPI-independent; `viewport.dpi` is carried
+//! for physical-size needs elsewhere but is not part of the fit comparison.
+
+use super::viewport::Viewport;
+use crate::tokens::layout::{PAGE_FIT_GUTTER_PX, PAGE_FIT_HYSTERESIS_PX};
+
+/// The renderer posture the page-fit rule recommends.
+///
+/// Format-neutral (no dependency on any app's view-mode enum); consumers map it
+/// onto their own renderer selector.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PageFit {
+    /// A page column fits — render paginated.
+    Paginated,
+    /// A page column does not fit — render reflowed to avoid horizontal scroll.
+    Reflow,
+}
+
+/// The viewport width (CSS px) a page of `page_width_px` needs to display at the
+/// viewport's zoom, including a gutter on each side.
+#[must_use]
+pub fn required_page_width(viewport: Viewport, page_width_px: f32) -> f32 {
+    page_width_px * viewport.zoom + 2.0 * PAGE_FIT_GUTTER_PX
+}
+
+/// Whether the page fits *without* hysteresis — the bare predicate (use
+/// [`resolve_page_fit`] for the renderer decision, which is sticky).
+#[must_use]
+pub fn page_fits(viewport: Viewport, page_width_px: f32) -> bool {
+    viewport.inner_width_px >= required_page_width(viewport, page_width_px)
+}
+
+/// Resolves the renderer posture with hysteresis, given the *current* posture.
+///
+/// Switches to [`PageFit::Paginated`] only when the page fits with the full
+/// hysteresis band to spare, and to [`PageFit::Reflow`] only when it overflows
+/// by the band; within the `2×PAGE_FIT_HYSTERESIS_PX` dead-band the current
+/// posture holds. An unmeasured viewport (`inner_width_px <= 0`) keeps the
+/// current posture (nothing to decide yet).
+#[must_use]
+pub fn resolve_page_fit(
+    viewport: Viewport,
+    page_width_px: f32,
+    currently_paginated: bool,
+) -> PageFit {
+    if viewport.inner_width_px <= 0.0 {
+        return if currently_paginated {
+            PageFit::Paginated
+        } else {
+            PageFit::Reflow
+        };
+    }
+    let needed = required_page_width(viewport, page_width_px);
+    let avail = viewport.inner_width_px;
+    if currently_paginated {
+        // Stay paginated until the page clearly overflows.
+        if avail < needed - PAGE_FIT_HYSTERESIS_PX {
+            PageFit::Reflow
+        } else {
+            PageFit::Paginated
+        }
+    } else {
+        // Switch to paginated only when the page clearly fits.
+        if avail >= needed + PAGE_FIT_HYSTERESIS_PX {
+            PageFit::Paginated
+        } else {
+            PageFit::Reflow
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "page_fit_tests.rs"]
+mod tests;
diff --git a/appthere-ui/src/responsive/page_fit_tests.rs b/appthere-ui/src/responsive/page_fit_tests.rs
new file mode 100644
index 00000000..a354c51b
--- /dev/null
+++ b/appthere-ui/src/responsive/page_fit_tests.rs
@@ -0,0 +1,87 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::{resolve_page_fit, PageFit};
+use crate::responsive::Viewport;
+
+/// Default A4 page width (CSS px), as `DocumentState` seeds it.
+const PAGE: f32 = 794.0;
+
+fn vp(width: f32) -> Viewport {
+    Viewport::new(width)
+}
+
+// Spec 03 M2 acceptance — window-free page-fit decisions (Spec 02 harness style).
+
+#[test]
+fn landscape_phone_that_fits_a_page_renders_paginated() {
+    // ~iPhone Pro Max landscape (926 px) clears the page + gutter + hysteresis.
+    assert_eq!(resolve_page_fit(vp(926.0), PAGE, false), PageFit::Paginated);
+}
+
+#[test]
+fn narrow_desktop_window_that_cannot_fit_a_page_renders_reflow() {
+    // A 700-px split-screen desktop window can't fit a 794-px page.
+    assert_eq!(resolve_page_fit(vp(700.0), PAGE, true), PageFit::Reflow);
+}
+
+#[test]
+fn dragging_across_the_boundary_does_not_thrash() {
+    // Walk the width down through the dead-band, then back up, carrying the
+    // resolved mode forward as the "current" posture each step (as the editor
+    // does). The mode must flip at most once in each direction, and only at the
+    // band edges — never oscillate within the band.
+    let widths_down: Vec<f32> = (700..=1000).rev().map(|w| w as f32).collect();
+    let mut paginated = true; // start wide & paginated
+    let mut transitions = 0;
+    for w in widths_down {
+        let next = resolve_page_fit(vp(w), PAGE, paginated) == PageFit::Paginated;
+        if next != paginated {
+            transitions += 1;
+            // Going narrower, the only allowed flip is paginated→reflow.
+            assert!(paginated && !next, "unexpected flip at width {w}");
+        }
+        paginated = next;
+    }
+    assert_eq!(transitions, 1, "should flip exactly once dragging narrower");
+    assert!(!paginated, "narrowest width must end reflowed");
+
+    // Now widen back up.
+    let mut transitions_up = 0;
+    for w in 700..=1000 {
+        let next = resolve_page_fit(vp(w as f32), PAGE, paginated) == PageFit::Paginated;
+        if next != paginated {
+            transitions_up += 1;
+            assert!(!paginated && next, "unexpected flip at width {w}");
+        }
+        paginated = next;
+    }
+    assert_eq!(transitions_up, 1, "should flip exactly once dragging wider");
+    assert!(paginated, "widest width must end paginated");
+}
+
+#[test]
+fn dead_band_holds_whichever_mode_entered_it() {
+    // 842 px = exactly page + gutters (needed). Inside [794, 890) the decision is
+    // sticky: the same width yields different results depending on entry mode.
+    assert_eq!(resolve_page_fit(vp(842.0), PAGE, true), PageFit::Paginated);
+    assert_eq!(resolve_page_fit(vp(842.0), PAGE, false), PageFit::Reflow);
+}
+
+#[test]
+fn zoom_scales_the_page_so_a_fitting_window_can_stop_fitting() {
+    // 1000 px fits the page at 100% …
+    assert_eq!(
+        resolve_page_fit(vp(1000.0), PAGE, false),
+        PageFit::Paginated
+    );
+    // … but at 150% the page needs ~1239 px, so 1000 no longer fits.
+    let zoomed = Viewport::new(1000.0).with_zoom(1.5);
+    assert_eq!(resolve_page_fit(zoomed, PAGE, true), PageFit::Reflow);
+}
+
+#[test]
+fn unmeasured_viewport_keeps_the_current_posture() {
+    assert_eq!(resolve_page_fit(vp(0.0), PAGE, true), PageFit::Paginated);
+    assert_eq!(resolve_page_fit(vp(0.0), PAGE, false), PageFit::Reflow);
+}
diff --git a/appthere-ui/src/responsive/viewport.rs b/appthere-ui/src/responsive/viewport.rs
new file mode 100644
index 00000000..f597f361
--- /dev/null
+++ b/appthere-ui/src/responsive/viewport.rs
@@ -0,0 +1,100 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! The measured viewport — the single source of truth for canvas placement and
+//! window-size classification across the AppThere suite.
+
+use super::breakpoint::Breakpoint;
+
+/// Default logical DPI (CSS reference). `inner_width_px` is already in CSS px,
+/// so this is a reference value for physical-size math (page-fit, Spec 03 M2),
+/// not a scale applied to the width.
+pub const DEFAULT_DPI: f32 = 96.0;
+
+/// The measured viewport: the inner width of the document scroll container, plus
+/// the zoom and DPI needed to reason about physical fit.
+///
+/// **One source of truth.** This replaces the former `window_width` signal,
+/// which defaulted to 1280 px and was never written (Spec 01 audit A-1), so
+/// hit-testing assumed a 1280-px window while rendered content used the real
+/// measured width — the two diverged on every other window size. All canvas
+/// origin / flex-centring math derives from this one measured value via
+/// [`Viewport::centred_origin_x`].
+///
+/// **Relocated to `appthere_ui` (Spec 03 M1)** from `loki-text` so Presentation
+/// and Spreadsheet share one viewport + breakpoint classification; it carries no
+/// app-specific assumptions.
+///
+/// `inner_width_px` is `0.0` until the first measurement arrives; the centring
+/// math clamps to `>= 0`, and an unmeasured viewport classifies as
+/// [`Breakpoint::Compact`] (mobile-first, corrected on the first measured
+/// frame). Page geometry stays per-document and is passed as the
+/// `content_width_px` argument rather than living on this type.
+///
+/// `zoom` (1.0 = 100%) and `dpi` are carried for the Spec 03 M2 page-fit
+/// renderer switch; the [`Breakpoint`] classification itself depends only on
+/// `inner_width_px`.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub struct Viewport {
+    /// Measured inner width of the document scroll container, in CSS pixels.
+    pub inner_width_px: f32,
+    /// Zoom factor applied to document content; `1.0` = 100%.
+    pub zoom: f32,
+    /// Logical DPI for physical-size reasoning; see [`DEFAULT_DPI`].
+    pub dpi: f32,
+}
+
+impl Default for Viewport {
+    fn default() -> Self {
+        Self {
+            inner_width_px: 0.0,
+            zoom: 1.0,
+            dpi: DEFAULT_DPI,
+        }
+    }
+}
+
+impl Viewport {
+    /// Builds a viewport from the measured scroll-container width (CSS px), with
+    /// default zoom (100%) and DPI.
+    #[must_use]
+    pub fn new(inner_width_px: f32) -> Self {
+        Self {
+            inner_width_px,
+            ..Self::default()
+        }
+    }
+
+    /// Returns a copy with `zoom` set (1.0 = 100%).
+    #[must_use]
+    pub fn with_zoom(mut self, zoom: f32) -> Self {
+        self.zoom = zoom;
+        self
+    }
+
+    /// Returns a copy with `dpi` set.
+    #[must_use]
+    pub fn with_dpi(mut self, dpi: f32) -> Self {
+        self.dpi = dpi;
+        self
+    }
+
+    /// The window-size class for this viewport's measured width (Spec 03 §5).
+    #[must_use]
+    pub fn breakpoint(&self) -> Breakpoint {
+        Breakpoint::from_width(self.inner_width_px)
+    }
+
+    /// The left edge (CSS px) of an element of `content_width_px` that is
+    /// flex-centred within the viewport — the document page (paginated) or the
+    /// reflow tile (reflow). Clamped to `>= 0` so content wider than the
+    /// viewport pins to the left rather than going negative.
+    #[must_use]
+    pub fn centred_origin_x(&self, content_width_px: f32) -> f32 {
+        ((self.inner_width_px - content_width_px) / 2.0).max(0.0)
+    }
+}
+
+#[cfg(test)]
+#[path = "viewport_tests.rs"]
+mod tests;
diff --git a/appthere-ui/src/responsive/viewport_tests.rs b/appthere-ui/src/responsive/viewport_tests.rs
new file mode 100644
index 00000000..dc4f6373
--- /dev/null
+++ b/appthere-ui/src/responsive/viewport_tests.rs
@@ -0,0 +1,62 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::{Viewport, DEFAULT_DPI};
+use crate::responsive::Breakpoint;
+
+#[test]
+fn page_centres_within_a_wider_viewport() {
+    // 1000-px viewport, 816-px page → (1000 − 816)/2 = 92.
+    let vp = Viewport::new(1000.0);
+    assert!((vp.centred_origin_x(816.0) - 92.0).abs() < 1e-4);
+}
+
+#[test]
+fn reflow_tile_spanning_the_viewport_has_zero_offset() {
+    // Reflow tiles span the full measured width, so the offset is 0 regardless
+    // of the value — the bug class (a 1280 default vs. a 1000 real width giving
+    // a spurious 140-px offset) cannot recur.
+    let vp = Viewport::new(1000.0);
+    assert_eq!(vp.centred_origin_x(1000.0), 0.0);
+    let vp = Viewport::new(1373.0);
+    assert_eq!(vp.centred_origin_x(1373.0), 0.0);
+}
+
+#[test]
+fn content_wider_than_viewport_pins_left() {
+    let vp = Viewport::new(600.0);
+    assert_eq!(vp.centred_origin_x(816.0), 0.0);
+}
+
+#[test]
+fn unmeasured_viewport_pins_left_and_is_compact() {
+    let vp = Viewport::default();
+    assert_eq!(vp.inner_width_px, 0.0);
+    assert_eq!(vp.centred_origin_x(816.0), 0.0);
+    // Mobile-first: an unmeasured viewport classifies Compact.
+    assert_eq!(vp.breakpoint(), Breakpoint::Compact);
+}
+
+#[test]
+fn new_defaults_zoom_and_dpi() {
+    let vp = Viewport::new(800.0);
+    assert_eq!(vp.zoom, 1.0);
+    assert_eq!(vp.dpi, DEFAULT_DPI);
+}
+
+#[test]
+fn zoom_and_dpi_setters_do_not_disturb_width_or_breakpoint() {
+    let vp = Viewport::new(1280.0).with_zoom(1.5).with_dpi(144.0);
+    assert_eq!(vp.zoom, 1.5);
+    assert_eq!(vp.dpi, 144.0);
+    assert_eq!(vp.inner_width_px, 1280.0);
+    // Breakpoint depends on width only — zoom must not change the class.
+    assert_eq!(vp.breakpoint(), Breakpoint::Expanded);
+}
+
+#[test]
+fn breakpoint_delegates_to_width_classification() {
+    assert_eq!(Viewport::new(375.0).breakpoint(), Breakpoint::Compact);
+    assert_eq!(Viewport::new(800.0).breakpoint(), Breakpoint::Medium);
+    assert_eq!(Viewport::new(1440.0).breakpoint(), Breakpoint::Expanded);
+}
diff --git a/appthere-ui/src/tokens/layout.rs b/appthere-ui/src/tokens/layout.rs
index 62385dec..e5cfdac7 100644
--- a/appthere-ui/src/tokens/layout.rs
+++ b/appthere-ui/src/tokens/layout.rs
@@ -40,6 +40,17 @@ pub const PAGE_HEIGHT_PX: f32 = 1123.0;
 /// Vertical gap between stacked pages in the editor scroll canvas (px).
 pub const PAGE_GAP_PX: f32 = 24.0;
 
+/// Horizontal breathing room (CSS px) required on **each** side of the page for
+/// it to count as fitting the viewport — so paginated view is kept only when the
+/// page isn't edge-to-edge. Spec 03 M2 page-fit switch
+/// ([`crate::responsive::resolve_page_fit`]).
+pub const PAGE_FIT_GUTTER_PX: f32 = 24.0;
+
+/// Hysteresis dead-band half-width (CSS px) around the page-fit threshold. A
+/// window dragged to exactly the boundary must cross `threshold ± this` to flip
+/// renderers, so it cannot thrash. Spec 03 M2.
+pub const PAGE_FIT_HYSTERESIS_PX: f32 = 48.0;
+
 /// Standard document page margin in CSS pixels (≈ 1 inch at 96 dpi).
 ///
 /// Used to derive text content width: `PAGE_WIDTH_PX - 2 × PAGE_MARGIN_PX = 650 px`.
@@ -62,8 +73,32 @@ pub const RIBBON_TOTAL_HEIGHT: f32 = RIBBON_TAB_STRIP_HEIGHT + RIBBON_CONTENT_HE
 
 // ── Responsive breakpoints ────────────────────────────────────────────────────
 
-/// Viewport width above which the UI switches to the desktop two-column layout.
+/// Upper bound (exclusive) of the **Compact** window-size class, in CSS px.
+/// Below this the UI is single-column, touch-first, non-paginated by default.
+/// Spec 03 §5.1 tier boundary. The classification lives in
+/// [`crate::responsive::Breakpoint`].
+pub const BREAKPOINT_COMPACT_MAX_PX: f32 = 600.0;
+
+/// Lower bound (inclusive) of the **Expanded** window-size class, in CSS px.
+/// At or above this the UI runs full chrome with side-by-side panels. The
+/// `[BREAKPOINT_COMPACT_MAX_PX, BREAKPOINT_EXPANDED_MIN_PX)` band is **Medium**.
+/// Spec 03 §5.1 tier boundary.
+pub const BREAKPOINT_EXPANDED_MIN_PX: f32 = 1024.0;
+
+/// Viewport width above which the home screen switches to its two-column
+/// layout.
+///
+/// **Deprecated as a general responsive threshold** — Spec 03 unifies window
+/// classification under [`crate::responsive::Breakpoint`] (Compact / Medium /
+/// Expanded at 600 / 1024). This constant remains only for `AtHomeTab`'s
+/// existing row↔column switch; the M5 cross-UI sweep reconciles it onto the
+/// breakpoint system.
 pub const BREAKPOINT_DESKTOP_PX: f32 = 768.0;
 
 /// Maximum width for primary action buttons on desktop (centered, fixed width).
 pub const BUTTON_WIDTH_DESKTOP_MAX: f32 = 320.0;
+
+/// Width (logical px) of a bounded side panel hosted by `AtPanelHost` at the
+/// Medium/Expanded size classes. At Compact the host fills the available width
+/// (a touch-first sheet) instead. See [`crate::AtPanelHost`].
+pub const PANEL_SIDE_WIDTH_PX: f32 = 360.0;
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 00000000..353b1777
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,8 @@
+# Clippy configuration for the Loki workspace (Spec 01 enforcement).
+#
+# `clippy::unwrap_used` / `clippy::expect_used` are enabled in CI to keep
+# panicking `.unwrap()` / `.expect()` out of library runtime code (audit A-5).
+# Test code may use them freely — these options exempt `#[cfg(test)]` modules
+# and `#[test]` functions so the gate targets shipped code only.
+allow-unwrap-in-tests = true
+allow-expect-in-tests = true
diff --git a/diff_flow.txt b/diff_flow.txt
deleted file mode 100644
index 5256cd16..00000000
Binary files a/diff_flow.txt and /dev/null differ
diff --git a/docs/adr/0009-target-architecture.md b/docs/adr/0009-target-architecture.md
new file mode 100644
index 00000000..924ac5fd
--- /dev/null
+++ b/docs/adr/0009-target-architecture.md
@@ -0,0 +1,265 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# ADR-0009: Target layering & crate-dependency invariants
+
+**Status:** Proposed
+**Date:** 2026-06-28
+**Deciders:** AppThere engineering
+**Companion to:** [`spec-01-codebase-audit-and-architecture.md`](spec-01-codebase-audit-and-architecture.md) (§5)
+**Depends on:** [`spec-01-audit-report.md`](spec-01-audit-report.md) (M1 — raw dependency graph)
+
+---
+
+## Context
+
+Spec 01 §5 asks for a target layering **derived from the crates that already
+exist**, validated against the real `cargo metadata` graph, with the violations
+the audit found against each boundary and a migration path to conformance
+(**D3 — reachable, not ideal**). This ADR is the **M2** deliverable.
+
+The good news from M1: the workspace is already a clean, near-acyclic layered
+graph. The proposed architecture is therefore **descriptive of where the code
+already is**, with exactly one boundary to repair (A-8) and two classification
+refinements over the spec's first sketch. Nothing here is an idealised rewrite.
+
+The spec's §5 sketch named `appthere-color` and a generic "loro_bridge" crate;
+neither exists as a standalone member. `loro_bridge` is a **module inside
+`loki-doc-model`** (`loki-doc-model/src/loro_bridge/`), and colour lives in
+`loki-primitives` / `loki-graphics`. The layering below is corrected to the real
+25-crate membership.
+
+---
+
+## Decision
+
+Adopt the following **seven-layer** target, with dependencies flowing **strictly
+downward** (a crate may depend only on its own layer or below). Layer 0 is the
+leaf foundation.
+
+```
+ L6  app        loki-text · loki-spreadsheet · loki-presentation
+                ───────────────────────────────────────────────────────────
+ L5  ui /       appthere-ui · loki-app-shell
+     app-shell  (design system, shared runtime services: SpellService, i18n)
+                ───────────────────────────────────────────────────────────
+ L4  render     loki-renderer · loki-vello · appthere-canvas · loki-render-cache
+                ───────────────────────────────────────────────────────────
+ L3b export+    loki-pdf            (exporters that REUSE layout for positioning)
+ L3  layout     loki-layout         (pagination · Parley text layout)
+                ═══════════ UDOM waist — narrow, format-neutral boundary ════
+ L2  io/serde   loki-odf · loki-ooxml · loki-opc · loki-epub
+                (loro_bridge lives inside loki-doc-model, not here)
+                ───────────────────────────────────────────────────────────
+ L1  model      loki-doc-model · loki-sheet-model · loki-presentation-model
+                ───────────────────────────────────────────────────────────
+ L0  foundation loki-primitives · loki-fonts · loki-graphics ·
+                loki-i18n · loki-spell
+```
+
+The ACID test harness (`loki-acid`) sits outside the layering and depends across
+it by design; the dependency-direction gate
+(`scripts/check-dependency-direction.py`) exempts it by an explicit allow-list,
+not silently. (`loki-templates` is *not* exempt — it is a real runtime content
+dependency of the app binaries, mapped at **L2**.)
+
+---
+
+## The invariants (§5.1) and how each holds today
+
+### I1 — Acyclic, downhill-only dependencies
+
+`model` never imports `render`/`layout`/`ui`; `render` never imports `ui`.
+
+**Status: holds with one exception.** Validated against the M1 graph:
+
+- `loki-doc-model → loki-primitives` only. `loki-sheet-model → loki-primitives`.
+  `loki-presentation-model → loki-graphics`. **No model crate imports
+  layout/render/ui.** ✅
+- `loki-layout → loki-doc-model, loki-fonts, loki-primitives, loki-spell` — all
+  L0/L1, downhill. ✅
+- `loki-vello → appthere-canvas, loki-layout` — L4/L3, downhill. ✅
+- **Violation (A-8) — ✅ resolved.** `loki-renderer → appthere-ui` was a single
+  **uphill** edge (render L4 → ui L5), via `use appthere_ui::tokens;` in
+  `document_view.rs` for two constants (`PAGE_GAP_PX`, `SPACE_6`). **Fixed** (M-1):
+  the two values are now **injected** into `DocumentViewProps` (`page_gap_px`,
+  `content_padding_bottom_px`) by the app — which legitimately depends on
+  `appthere_ui` — and the `appthere-ui` dependency is dropped from
+  `loki-renderer/Cargo.toml`. The graph is now **fully downhill**, enforced by
+  `scripts/check-dependency-direction.py` (A-13).
+
+No cycles exist.
+
+### I2 — The UDOM waist
+
+Serialization (ODF/OOXML) talks to the model through a narrow, format-neutral
+document interface; format-specific types do not leak upward into layout/render,
+and render types do not leak down into serialization.
+
+**Status: holds.** This is the strongest result of the audit:
+
+- `loki-odf` and `loki-ooxml` depend **only downward** on model + foundation
+  (`loki-doc-model`, `loki-sheet-model`, `loki-presentation-model`,
+  `loki-primitives`, `loki-graphics`, `loki-opc`). They import **no** layout,
+  render, or ui crate. ✅
+- Conversely, `loki-layout` and `loki-renderer` import `loki-doc-model` (the
+  neutral model) but **not** `loki-odf`/`loki-ooxml`. Format types therefore
+  cannot reach layout/render. ✅
+- Only the L6 app crates import both the model *and* the format crates — the
+  correct place to wire IO.
+
+The waist is real and intact; the gate's job (§6.3) is to keep `loki-odf` /
+`loki-ooxml` out of every dependents' set above L2.
+
+### I3 — Foundation purity
+
+`loki-primitives`, `loki-fonts`, `loki-graphics` (and `loki-i18n`, `loki-spell`)
+depend on nothing internal except, in a fixed order, each other.
+
+**Status: holds.** `loki-primitives`, `loki-fonts`, `loki-i18n`, `loki-spell`
+are leaves (no internal deps). `loki-graphics → loki-primitives` is the only
+intra-foundation edge and is acyclic. ✅ (Note: the spec's `appthere-color` does
+not exist; colour responsibilities live in `loki-primitives`/`loki-graphics`.)
+
+### I4 — `forbid(unsafe_code)` everywhere except documented Android crates
+
+**Status: holds in spirit, needs structural hardening.** 22 of 25 crate roots
+carry `#![forbid(unsafe_code)]`. The three that don't —
+`loki-text`, `loki-presentation`, `loki-spreadsheet` — are exactly the documented
+Android `NativeActivity` FFI crates, and each `unsafe` call carries a `// SAFETY:`
+comment (audit §3.3). The hardening (migration M-4): replace the *absence* of the
+attribute with `#![deny(unsafe_code)]` + a narrowly-scoped `#[allow(unsafe_code)]`
+on the FFI entry item, and enumerate the three crates in a checked-in allow-list
+so a fourth unsafe crate cannot appear silently.
+
+---
+
+## Refinements over the spec's §5 sketch (D3)
+
+Two places where the real graph diverges from the spec's first diagram, resolved
+pragmatically rather than forced:
+
+1. **Exporters split across the layout boundary (L3b).** The spec put all
+   serialization in one io/serde band below layout. But `loki-pdf` *reuses*
+   `loki-layout` for positioning (`loki-pdf → loki-layout`), so it cannot sit
+   below layout. Resolution: pure-serialization exporters that touch only the
+   model (`loki-epub → loki-doc-model, loki-primitives`; `loki-odf`; `loki-ooxml`;
+   `loki-opc`) stay in the **L2 waist**; layout-consuming exporters (`loki-pdf`,
+   and any future paginating exporter) form a thin **L3b "export-above-layout"**
+   tier. This is a classification fix, **not** a code change (audit A-9).
+
+2. **`loro_bridge` is not a crate.** It is a module tree inside `loki-doc-model`
+   (`src/loro_bridge/`). The CRDT bridge therefore lives in **L1 (model)**, which
+   is consistent with the waist: the bridge is part of the neutral model, not a
+   format. The diagram is corrected accordingly.
+
+3. **`appthere-canvas` naming vs. layer.** The `appthere-*` prefix elsewhere
+   denotes the L5 UI design system, but `appthere-canvas` is a **render-layer**
+   crate (`loki-vello → appthere-canvas`; `appthere-canvas → loki-render-cache`).
+   Pure naming smell (audit-adjacent); no dependency violation. Left as-is, noted
+   so the dependency gate's layer-assignment table is explicit rather than
+   inferred from the prefix.
+
+---
+
+## Per-boundary violation list & migration paths (§5.2)
+
+| Boundary / invariant | Violations found (M1) | Migration |
+|---|---|---|
+| I1 render ⊁ ui | `loki-renderer → appthere-ui` (`document_view.rs`, design tokens) | ✅ **Done (M-1)** — tokens injected via `DocumentViewProps`; `appthere-ui` dep dropped from `loki-renderer`. Enforced by the dependency-direction gate. |
+| I2 waist | none | hold the line via the §6.3 gate (forbid `loki-odf`/`loki-ooxml` above L2) |
+| I3 foundation purity | none | gate: foundation crates may import only foundation |
+| I4 unsafe | 3 crates omit the attribute (expected) | **M-4:** `deny(unsafe_code)` + scoped `allow` + checked-in allow-list |
+| L3b classification | `loki-pdf → loki-layout` (not a violation) | **M-2:** encode the L3b tier in the gate's layer map |
+
+`loro_bridge` placement (**M-3**) and the `appthere-canvas` naming note are
+documentation-only.
+
+**Migration order.** M-1 is the only behaviourally-adjacent move and is small
+(one `use` relocated to a lower crate). M-2/M-3 are layer-map entries. M-4 is
+mechanical. None require a rewrite — consistent with D3: the target is reached by
+*one* token relocation plus gate configuration, so the architecture is genuinely
+*reachable*, not aspirational.
+
+---
+
+## Consequences
+
+**Positive**
+
+- The dependency-direction CI gate (Spec 01 §6.3) has an unambiguous,
+  machine-checkable layer map to enforce, anchored to real crate names.
+- Spec 03 (Responsive) inherits a clean render↔layout boundary once M-1 lands and
+  the `Viewport` source-of-truth (D4 / audit A-1) is threaded.
+- The waist (I2) is already intact, so format work and render work can proceed
+  independently without re-introducing leakage — the gate makes that durable.
+
+**Negative / costs**
+
+- M-1 touches `loki-renderer` and wherever the relocated tokens are consumed; the
+  token crate adds one foundation member. Small, but not zero.
+- The layer map must be maintained as crates are added (mitigated: the gate fails
+  on any unmapped crate, forcing an explicit layer assignment at PR time).
+
+**Neutral**
+
+- `loki-acid` / `loki-templates` are declared test/support members and exempted
+  from the gate by explicit allow-list, not by silence.
+
+---
+
+## Validation appendix — layer assignment table (gate input)
+
+| Crate | Layer | Internal deps (must all be ≤ layer) |
+|---|---|---|
+| loki-primitives | L0 | — |
+| loki-fonts | L0 | — |
+| loki-i18n | L0 | — |
+| loki-spell | L0 | — |
+| loki-graphics | L0 | loki-primitives |
+| loki-doc-model | L1 | loki-primitives |
+| loki-sheet-model | L1 | loki-primitives |
+| loki-presentation-model | L1 | loki-graphics |
+| loki-opc | L2 | — |
+| loki-odf | L2 | loki-doc-model, loki-primitives, loki-sheet-model |
+| loki-ooxml | L2 | loki-doc-model, loki-graphics, loki-opc, loki-presentation-model, loki-primitives, loki-sheet-model |
+| loki-epub | L2 | loki-doc-model, loki-primitives |
+| loki-layout | L3 | loki-doc-model, loki-fonts, loki-primitives, loki-spell |
+| loki-pdf | L3b | loki-doc-model, loki-layout, loki-primitives |
+| loki-render-cache | L4 | — |
+| appthere-canvas | L4 | loki-render-cache |
+| loki-vello | L4 | appthere-canvas, loki-layout |
+| loki-renderer | L4 | appthere-canvas, loki-doc-model, loki-layout, loki-vello (A-8 `appthere-ui` edge removed) |
+| appthere-ui | L5 | loki-i18n |
+| loki-app-shell | L5 | loki-i18n, loki-spell |
+| loki-text | L6 | appthere-ui, loki-app-shell, loki-doc-model, loki-epub, loki-fonts, loki-i18n, loki-layout, loki-odf, loki-ooxml, loki-pdf, loki-renderer, loki-templates, loki-vello |
+| loki-spreadsheet | L6 | appthere-ui, loki-app-shell, loki-doc-model, loki-fonts, loki-i18n, loki-layout, loki-odf, loki-ooxml, loki-renderer, loki-sheet-model, loki-vello |
+| loki-presentation | L6 | appthere-ui, loki-app-shell, loki-doc-model, loki-fonts, loki-graphics, loki-i18n, loki-layout, loki-odf, loki-ooxml, loki-presentation-model, loki-renderer, loki-vello |
+| loki-acid | test | (exempt) |
+| loki-templates | L2 | loki-doc-model, loki-ooxml, loki-primitives |
+| appthere-conformance | test | (exempt) |
+| loki-bench | test | (exempt — benchmark harness) |
+| loki-model | L7 | — |
+| loki-crypto | L7 | — |
+| loki-server-audit | L7 | — |
+| loki-print | L7 | — |
+| loki-server-store | L8 | loki-crypto, loki-model, loki-server-audit |
+| loki-server-auth | L8 | loki-model |
+| loki-convert | L8 | loki-doc-model, loki-epub, loki-odf, loki-ooxml, loki-pdf, loki-sheet-model |
+| loki-server-collab | L9 | loki-model, loki-server-store |
+| loki-server-api | L10 | loki-crypto, loki-model, loki-server-audit, loki-server-auth, loki-server-collab, loki-server-store |
+| loki-server | L11 | loki-crypto, loki-model, loki-server-api, loki-server-auth, loki-server-collab, loki-server-store |
+| loki-headless | L11 | loki-convert, loki-print |
+
+**Server subsystem (L7–L11)** was added when `main`'s web-server / headless
+effort (spec ADRs C012–C028) merged in: a separate backend stack that consumes
+the document/format libraries (`loki-convert` reaches down to `loki-pdf` at L3b)
+but is never consumed by the client app binaries, so it sits above L6. The
+layers order those crates by their own dependency graph.
+
+The former A-8 `loki-renderer → appthere-ui` edge has been removed (M-1), so
+**every edge is now conformant** — `scripts/check-dependency-direction.py`
+verifies all internal edges flow downhill (35 mapped crates + the exempt
+`loki-acid` / `appthere-conformance` / `loki-bench` harnesses) and fails CI on
+any future uphill edge.
diff --git a/docs/adr/0010-per-crate-licensing.md b/docs/adr/0010-per-crate-licensing.md
new file mode 100644
index 00000000..73cad699
--- /dev/null
+++ b/docs/adr/0010-per-crate-licensing.md
@@ -0,0 +1,105 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# ADR-0010: Per-crate licensing — `loki-opc` is MIT, the suite is Apache-2.0
+
+**Status:** Accepted
+**Date:** 2026-06-28
+**Deciders:** AppThere engineering
+**Relates to:** [`spec-01-audit-report.md`](spec-01-audit-report.md) finding A-3; Spec 01 §6.2 (`spdx_header_line_one`)
+
+---
+
+## Context
+
+The Loki suite is licensed **Apache-2.0** — the root `LICENSE` is the Apache
+2.0 text and every first-party crate declares `license = "Apache-2.0"` in its
+`Cargo.toml`, with `// SPDX-License-Identifier: Apache-2.0` on line 1 of each
+`.rs` file.
+
+**`loki-opc` is the deliberate exception.** It implements the Open Packaging
+Conventions (ISO/IEC 29500-2) container layer — a self-contained, format-neutral
+concern with no Loki-specific dependencies. It is intended to be **released as a
+standalone crate** (its `Cargo.toml` already carries
+`repository = "https://github.com/appthere/loki-opc"`), and for the widest
+possible downstream reuse it will be published under the **MIT** license, not
+Apache-2.0. The manifest already reflects this (`license = "MIT"`), and the
+source files already carry `// SPDX-License-Identifier: MIT`.
+
+Two problems motivated this ADR:
+
+1. **The distinction was undocumented.** Nothing in the docs or CLAUDE.md
+   explained why one crate diverges; CLAUDE.md's convention text said, flatly,
+   that every `.rs` file must begin with the *Apache-2.0* SPDX line — which is
+   wrong for `loki-opc` and would mislead a contributor or a naïve gate into
+   "correcting" MIT headers to Apache.
+2. **The distinction was unenforced, and inconsistently applied.** The Spec 01
+   audit's A-3 finding ("`loki-opc` missing SPDX headers") was a **false
+   positive** — its scan matched only the literal `Apache-2.0` string, so the
+   MIT headers read as absent. The real issues the corrected audit surfaced were
+   smaller: `loki-opc` files placed the SPDX id on **line 2** (copyright on line
+   1), violating the SPDX-on-line-1 convention and the ordering every Apache
+   crate uses, and one test file (`tests/package_tests.rs`) genuinely had no
+   header.
+
+## Decision
+
+1. **`loki-opc` is MIT-licensed; the rest of the AppThere/Loki workspace is
+   Apache-2.0.** This is a per-crate property, declared authoritatively by each
+   crate's `Cargo.toml` `license` field.
+2. **Each `.rs` file's line-1 SPDX identifier must match its crate's declared
+   license.** Uniform shape across the suite: line 1 is
+   `// SPDX-License-Identifier: <license>`, line 2 is the copyright line. The
+   `loki-opc` files were reordered to put MIT SPDX on line 1; `package_tests.rs`
+   received the header.
+3. **`loki-opc` ships its own MIT `LICENSE` file** (`loki-opc/LICENSE`) so the
+   standalone release is self-contained; the root Apache `LICENSE` continues to
+   govern the rest of the workspace.
+4. **A license-aware gate enforces (2)** in CI:
+   `scripts/check-license-headers.py` resolves each first-party `.rs` file to its
+   owning crate, reads that crate's `Cargo.toml` `license`, and fails if line 1
+   is not the matching SPDX id. The vendored `patches/*` tree (upstream
+   `MIT OR Apache-2.0`) is out of scope; a reviewed
+   `scripts/license-header-exceptions.txt` allow-list exists for any future
+   exception.
+
+This realises the `spdx_header_line_one` gate Spec 01 §6.2 reserved, generalised
+from "Apache-2.0 on line 1" to "the *crate's* license on line 1" so the MIT/Apache
+split is mechanically un-violable rather than convention-only.
+
+## Consequences
+
+**Positive**
+
+- The MIT/Apache boundary is documented and enforced; a PR that adds an Apache
+  header to a `loki-opc` file (or vice-versa), or omits a header, fails CI.
+- `loki-opc` is publish-ready: manifest, per-file SPDX, and a crate-local MIT
+  `LICENSE` all agree.
+- The gate is future-proof: a new crate is checked against *its own* declared
+  license with no gate change; adding a second MIT (or differently-licensed)
+  crate "just works."
+- Corrects the Spec 01 A-3 false positive with an honest, narrower finding.
+
+**Negative / costs**
+
+- Contributors must keep `Cargo.toml` `license` and the file headers in sync —
+  but that is exactly what the gate checks, so drift surfaces immediately.
+- A crate that legitimately needs a mixed/expression license (`MIT OR
+  Apache-2.0`) would need the gate's single-line expectation extended; not
+  needed today (only `patches/*`, which is excluded).
+
+**Neutral**
+
+- No code behaviour changes — header reordering is comment-only.
+
+## Alternatives considered
+
+- **Keep the whole workspace Apache-2.0 (relicense `loki-opc`).** Rejected:
+  loses the permissive-license reach that motivates a standalone OPC crate.
+- **Document the exception but don't enforce it.** Rejected per Spec 01's thesis
+  (D2): unenforced conventions regress — the A-3 false positive and the line-2
+  drift are exactly that regression in miniature.
+- **A hardcoded crate→license map in the gate.** Rejected in favour of reading
+  `Cargo.toml`, so the manifest stays the single source of truth and new crates
+  need no gate edit.
diff --git a/docs/adr/0011-props-naming-convention.md b/docs/adr/0011-props-naming-convention.md
new file mode 100644
index 00000000..65144b14
--- /dev/null
+++ b/docs/adr/0011-props-naming-convention.md
@@ -0,0 +1,77 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# ADR-0011: `*Props` names two distinct concepts — and that's intentional
+
+**Status:** Accepted
+**Date:** 2026-06-28
+**Deciders:** AppThere engineering
+**Resolves:** [`spec-01-audit-report.md`](spec-01-audit-report.md) finding A-12
+
+---
+
+## Context
+
+The Spec 01 audit (A-12) flagged the `*Props` suffix as overloaded: it names two
+unrelated families of types.
+
+1. **Document-model formatting bags** — `ParaProps`, `CharProps`, `RunProps`,
+   `CellProps`, `TableProps`, `ShapeProps` (plus ODF variants `OdfParaProps`,
+   `OdfTextProps`, `OdfCellProps`). These live under `loki_doc_model::style::props`
+   (and the format crates) and mirror the OOXML vocabulary — `pPr` = paragraph
+   properties, `rPr` = run properties. They are plain data structs describing how
+   a paragraph/run/cell is formatted.
+2. **Dioxus component props** — `AtTitleBarProps`, `DocumentViewProps`,
+   `AtHomeTabProps`, … `#[derive(Props)]` structs in `appthere_ui` and the app
+   crates that carry a component's inputs.
+
+The audit rated this **low priority** and proposed an *optional* rename of the
+model bags to `*Format` / `*Attrs`.
+
+## Decision
+
+**Keep `*Props` for both. Do not rename.** Document the convention instead:
+
+- `*Props` under `loki_doc_model` / the format crates (`loki-ooxml`, `loki-odf`)
+  = a **formatting property bag**, following the OOXML `pPr`/`rPr` domain
+  vocabulary.
+- `*Props` deriving `dioxus::Props` = a **UI component's props**.
+
+The two never collide: they live in disjoint crates and module paths
+(`loki_doc_model::style::props::*` vs. the UI components), are never imported into
+the same scope, and one derives `Props` while the other does not. The suffix is
+read in context, exactly like `Config`/`Options` elsewhere.
+
+## Rationale & tradeoffs
+
+- **Blast radius is disproportionate to the benefit.** A rename would touch
+  **350+ references across 66+ files** — the core model, every format mapper
+  (DOCX/ODT/XLSX import *and* export), the layout engine, and the Loro CRDT
+  bridge. `ParaProps`/`CharProps` alone appear ~270 times.
+- **Real regression surface.** The bags flow through `loro_bridge` (CRDT
+  round-trip) and the OOXML/ODF mappers; a mechanical rename is *mostly* safe but
+  the cost/risk is real for a purely cosmetic gain on a "low-priority" item.
+- **The name is good domain vocabulary.** `ParaProps`/`CharProps` map directly to
+  `pPr`/`rPr`, which every reader of the format code already knows. `*Format` /
+  `*Attrs` would be *less* precise, not more.
+- **No functional confusion exists.** The overload is nominal only; the type
+  system and module paths keep them apart.
+
+## Consequences
+
+- This ADR is the convention of record; new model formatting bags use `*Props`,
+  new UI component props use `*Props` (deriving `dioxus::Props`).
+- If a future change ever places both in one scope (none is foreseen), the
+  *model* bag is the one to disambiguate — rename it to `*Format` in a dedicated,
+  separately-reviewed PR with the CRDT/mapper round-trip suite (Spec 02) green
+  before and after. That PR is explicitly **not** bundled into the audit fix
+  pass, because its risk profile is different from the mechanical hygiene fixes.
+
+## Alternatives considered
+
+- **Rename model bags to `*Format`/`*Attrs` now.** Rejected: 350+-reference,
+  cross-crate, serialization-adjacent change for a cosmetic, low-priority concern.
+  Available on explicit request as its own PR.
+- **Rename the UI props instead.** Rejected: `#[derive(Props)]` is Dioxus's own
+  convention; fighting it would surprise every Dioxus reader.
diff --git a/docs/adr/0012-style-resolution-and-page-styles.md b/docs/adr/0012-style-resolution-and-page-styles.md
new file mode 100644
index 00000000..2d266098
--- /dev/null
+++ b/docs/adr/0012-style-resolution-and-page-styles.md
@@ -0,0 +1,125 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# ADR-0012: Style resolution provenance, and the page-style asymmetry
+
+**Status:** Accepted
+**Date:** 2026-06-30
+**Deciders:** AppThere engineering
+**Resolves:** [`spec-05-style-management-panel.md`](spec-05-style-management-panel.md) §5 (resolution model + page-style asymmetry); [`spec-05-style-audit.md`](spec-05-style-audit.md) findings SM-1, SM-2, SM-9, SM-10, SM-12
+
+---
+
+## Context
+
+Spec 05 rebuilds the style-management panel around a **resolved-vs-overridden
+inspector**: every property shows not just its effective value but *where that
+value comes from*. The audit (SM-1) found resolution already exists for the
+renderer — `StyleCatalog::resolve_para` / `resolve_char` walk the single-parent
+chain and collapse properties (child wins) — but it returns **bare values with
+no provenance**, `resolve_char` is misnamed (it walks paragraph styles, not the
+character family; SM-2), and there is no cycle guard for the re-parenting the
+panel will offer (SM-12).
+
+Spec 05 §5 also calls out a structural asymmetry that must be decided "explicitly
+in the resolution-model ADR": **ODF has named, catalogued page styles**
+(`style:page-layout` + `style:master-page`); **OOXML has none** — page setup
+lives in section properties (`w:sectPr`). Loki today mirrors OOXML: page geometry
+is per-section in `layout::PageLayout`, with **no `page_styles` entry in the
+catalog** (SM-9). The inspector pattern (a named, selectable, inheritable entry
+per family) does not fit page styling as currently modelled.
+
+This ADR records two decisions: the **provenance resolution model** (Spec 05 M1,
+now implemented) and the **page-style representation** (decided here, realized
+with the M6 page panel).
+
+---
+
+## Decision 1 — Provenance resolution over the single-parent tree
+
+Resolution yields, per property, a **`(provenance, value)`** answer:
+
+```
+Local              — set on the queried style itself
+Inherited(StyleId) — first ancestor in the style's own `parent` chain that sets it
+Default            — not in that chain; supplied by the document default style
+                     (OOXML docDefaults / ODF default-style fall-through)
+FormatDefault      — unset everywhere; the engine supplies the value (value = None)
+```
+
+It is implemented in `loki-doc-model/src/style/resolve.rs` as:
+
+- `Provenance` and `Resolved<T> { provenance, value: Option<T> }` (`value` is
+  `None` only for `FormatDefault`).
+- A **generic, getter-based** resolver rather than a giant per-property result
+  struct: `resolve_para_chain(id, |s| …)` and `resolve_char_chain(id, |s| …)`.
+  The getter reads one property's *local* value from a style, so a single method
+  serves every property of a family, and the inspector resolves each row on
+  demand (cheap, lazy — relevant to Spec 06's measurement).
+- `resolve_para_chain` also serves a paragraph style's **run-default character
+  properties** (`|s| s.char_props.…`), and `resolve_char_chain` is the
+  standalone-`CharacterStyle` resolver the misnamed `resolve_char` never
+  provided (SM-2). The collapsing `resolve_para`/`resolve_char` stay as the
+  renderer's value-only fast path — this is additive.
+- **Cycle/depth safety** everywhere: a visited-set plus the existing
+  `MAX_STYLE_CHAIN_DEPTH = 32` cap. `para_reparent_cycles(child, new_parent)`
+  (backed by `para_ancestors`) lets the panel **reject** a re-parent that would
+  form a cycle, keeping each family a tree (Spec 05 §7 / D3).
+
+Rationale for the `Default` vs `Inherited` distinction: when a style *explicitly*
+bases on the document default, a property set there is `Inherited(<that name>)`
+— more informative than a generic "Default". `Default` is reserved for the
+`docDefaults` fall-through a style reaches **without** naming the default in its
+chain. (Verified by tests in `resolve_tests.rs`.)
+
+---
+
+## Decision 2 — Page styling: ODF-native named page styles in the catalog
+
+**We adopt the ODF model as the unified representation** (Spec 05 §5's lean):
+page styling will be a **named, catalogued family** — a future
+`StyleCatalog::page_styles` keyed by `StyleId`, each entry carrying page geometry
+(size, margins, orientation, columns) and its header/footer master, derived from
+today's `PageLayout`. On **export**:
+
+- **ODT** writes them natively as `style:page-layout` + `style:master-page`.
+- **DOCX** maps each page style to the **section properties** (`w:sectPr`) of the
+  sections that use it — there is no named OOXML page style to write, so the
+  mapping is page-style → section, the inverse of import.
+
+Page styles are an **explicit exception to the inheritance tree (D3)**: neither
+format gives page styles a `basedOn` parent, so the page family has **no
+parent chain**. In the panel it therefore behaves like the **list family**
+(SM-9): the inspector still shows each property with provenance — but only
+`Local` (set on this page style) and `FormatDefault` apply, and the **tree view
+degrades to a flat list** (Spec 05 §7's Compact degradation, here at every
+width). The resolution layer needs no page-specific code: a non-inheriting
+family is just a chain of length one.
+
+### Why not the alternatives
+
+- **Keep page setup per-section only, present sections as synthetic "page
+  styles."** Rejected: the inspector assumes a stable, named, selectable entry;
+  synthesizing one per section re-keys it on section identity (which shifts as
+  the document is edited) and has no home for the ODF master-page concept on
+  round-trip.
+- **Invent a Loki-specific page-inheritance tree.** Rejected: neither format
+  supports it, so it could not round-trip; D3 keeps the model matching the
+  formats' *actual* structure rather than forcing a uniform tree.
+
+---
+
+## Consequences
+
+- **M1 is unblocked and implemented** for resolution: the inspector (M2) reads
+  `Resolved<T>` per property; re-parenting (M4) uses `para_reparent_cycles`.
+- The page family is **decided but not yet built**: the `page_styles` catalog
+  field, the import mapping from `PageLayout`/`sectPr`, and the DOCX export
+  inverse land with the **M6 page panel** — not in M1. Until then the page panel
+  is absent (no dead UI, per the Spec 04 capability-gate discipline).
+- Page styles are documented as a **non-inheriting family**; the inspector and
+  tree-view code must treat "no parent chain" as a first-class case (already true
+  for lists).
+- No change to the renderer's existing `resolve_para`/`resolve_char` value path;
+  this ADR is additive. Spec 02's round-trip trust is assumed, not re-litigated.
diff --git a/docs/adr/0013-conditional-panels-are-components.md b/docs/adr/0013-conditional-panels-are-components.md
new file mode 100644
index 00000000..f666f36f
--- /dev/null
+++ b/docs/adr/0013-conditional-panels-are-components.md
@@ -0,0 +1,111 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# ADR-0013: Conditionally-mounted panels are components, not plain functions
+
+**Status:** Accepted
+**Date:** 2026-06-30
+**Deciders:** AppThere engineering
+**Resolves:** [`spec-05-style-management-panel.md`](spec-05-style-management-panel.md) §10 / D1 (the sanctioned conditional-panel context pattern); unblocks [`spec-03-responsive-audit.md`](spec-03-responsive-audit.md) R-13g
+
+---
+
+## Context
+
+Loki's editor shows several panels behind a condition — the style editor, the
+metadata (Dublin Core) editor, the language picker, the Publish/PDF panel. Today
+each is a **plain function called inside an `if`** with an early return:
+
+```rust
+// editor_inner.rs — the anti-pattern
+if editing_metadata.read().is_some() {
+    {metadata_panel(/* … positional args … */)}   // plain fn
+}
+// metadata_panel:
+let draft = match editing_metadata.read().clone() {
+    Some(d) => d,
+    None => return rsx! {},   // early return — no component identity
+};
+```
+
+That body has **no component identity**, so Dioxus gives it no hook scope: it
+cannot call a hook, including the resilient
+[`use_breakpoint()`](../../appthere-ui/src/responsive/mod.rs). The only way to
+make such a panel responsive was to compute `compact` in the parent and **thread
+a flag down** — which grew `editor_inner.rs` against its file-ceiling baseline.
+This is exactly why Spec 03 **deferred R-13g** (the metadata panel's label
+stacking at narrow widths): the panel could not read the breakpoint, and the
+flag-threading workaround breached the ceiling.
+
+The audit (`spec-05-style-audit.md`, SM-5/SM-6) confirmed both the problem and
+that the fix already works in-tree: `FontWarning` is a `#[component]` that calls
+`use_breakpoint()` successfully, and `use_breakpoint()` is resilient (returns
+`Breakpoint::Expanded` when no responsive context is provided, never panics).
+
+The style-management panel (Spec 05) is *entirely* conditionally-mounted family
+panels, so it owns and defines the pattern once, here, instead of per panel.
+
+---
+
+## Decision
+
+**A conditionally-shown panel is a `#[component]`, mounted at the boundary — not
+a plain function called inside `if`.**
+
+```rust
+// Mount at the boundary; the component handles its own hook scope.
+{open().then(|| rsx! {
+    AtPanelHost { title: fl!("styles-title"), close_aria_label: fl!("close"),
+                  on_close: move |_| open.set(false),
+        StyleInspector { /* … */ }
+    }
+})}
+```
+
+Consequences of the pattern:
+
+1. **The component owns its hook scope.** Dioxus manages it correctly across
+   mount/unmount, so the panel calls `use_breakpoint()` (and any other hook)
+   directly and adapts to the size class **with no `compact` flag threaded** from
+   the parent.
+2. **The parent does not grow.** Mounting is a single boundary expression
+   (`{cond.then(|| rsx!{ … })}`); no per-panel responsive plumbing lands in
+   `editor_inner.rs`, so its ceiling pressure disappears.
+3. **Panels are born responsive.** Every Spec 05 family panel and sub-panel is a
+   component from the start, each able to read the breakpoint.
+
+### `AtPanelHost` — the reusable boundary
+
+`appthere_ui::AtPanelHost` (`components/panel_host.rs`) is the shared host that
+realizes the pattern: a `#[component]` that reads `use_breakpoint()` itself and
+chooses posture via the pure, unit-tested `PanelPosture::for_breakpoint` — a
+**full-width touch-first sheet at Compact**, a **bounded side panel at
+Medium/Expanded**. It renders a titled, closable container (close control ≥
+`TOUCH_MIN` = 44 px). Per the Blitz constraints (CLAUDE.md): elevation is token
+border/background (**no `box-shadow`**) and it lives in flow (**no
+`position: fixed`**; use `position: absolute` in a positioned ancestor when a
+caller needs to dock it, per the spell-panel precedent). Spec 05 panels mount
+their inspector inside it.
+
+The responsive **decision** is a pure function (`PanelPosture::for_breakpoint`),
+matching the Spec 03 D1 discipline that responsive behaviour be testable without
+a real window; the component merely applies it.
+
+---
+
+## Consequences
+
+- **This is a standing project convention.** New conditionally-mounted surfaces
+  are components (ideally hosted by `AtPanelHost`), never plain fns in `if` with
+  an early `return rsx!{}`. See the CLAUDE.md “UI conventions” note.
+- **R-13g is unblocked, not yet closed.** Converting the metadata panel to a
+  component lets it read the breakpoint and stack its label at Compact; making
+  that change and ticking R-13g remains **Spec 03's** milestone. Spec 05 only
+  establishes the pattern (and `AtPanelHost`) that R-13g needs.
+- **Existing plain-fn panels are migrated opportunistically.** They are not
+  broken today (they render full chrome via the `Expanded` fallback), so each is
+  converted when its area is next touched — Spec 05's panels adopt the pattern
+  from the start; the editor's legacy panels follow as they are revisited.
+- No change to `use_breakpoint`'s resilience contract; this ADR is about *where*
+  the hook may be called (a component), not the hook itself.
diff --git a/docs/adr/spec-01-audit-report.md b/docs/adr/spec-01-audit-report.md
new file mode 100644
index 00000000..ef62a2e7
--- /dev/null
+++ b/docs/adr/spec-01-audit-report.md
@@ -0,0 +1,516 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 01 — Audit Report (M1)
+
+| | |
+|---|---|
+| **Status** | Draft — inventory complete, awaiting maintainer triage |
+| **Companion to** | [`spec-01-codebase-audit-and-architecture.md`](spec-01-codebase-audit-and-architecture.md) |
+| **Architecture ADR** | [`0009-target-architecture.md`](0009-target-architecture.md) (M2) |
+| **Method** | Read-only audit pass. **No production code changed.** |
+| **Snapshot** | branch `claude/adr-docs-setup-ogwz5a`, 2026-06-28 |
+| **Corpus** | 664 tracked `.rs` files · 25 workspace crates · Rust 2024 edition |
+
+This is the **M1** deliverable mandated by §3 / §8 of Spec 01: a complete,
+triageable inventory across every §4.1 smell category, the dedicated 1280px-class
+trace (§4.2), and the raw dependency graph. Per **D1 (surface-and-triage)** the
+**Priority** column of the triage table (§3) is left blank for the maintainer.
+Per the working method, **no fixes are applied in this pass** — enforcement (M3)
+and fixes (M4) follow maintainer triage.
+
+> **On counts.** Numbers below come from deterministic `git grep` / `cargo
+> metadata` / line-count scans, with `#[cfg(test)]` modules, `*_tests.rs`,
+> `tests/`, `benches/`, `examples/`, and the vendored `patches/` tree excluded
+> from "production library" totals unless stated. Test code is explicitly exempt
+> (§4.1) — its `unwrap()`s and large files are acceptable. Where a heuristic can
+> over- or under-count, the report says so rather than rounding up.
+
+---
+
+## 1. Executive summary
+
+The codebase is in **substantially better shape than the spec's framing
+implies**. Most of Loki's stated conventions already largely hold; the problem
+is that *almost none of them are mechanically enforced* (§13), so they regress
+silently. The headline findings:
+
+- **The 1280px class was real and load-bearing (A-1) — now fixed.**
+  `window_width` was a `Signal<f32>` initialised to `1280.0` in `editor_state.rs`
+  and **never written again**, while the *actually measured* viewport width lived
+  in a *separate* value (`scroll_metrics.client_width`, from `get_client_rect()`)
+  used for reflow. Hit-testing read the stale 1280; rendering read the real width
+  — so they diverged on any non-1280 window, drifting click-to-caret mapping. The
+  signal is deleted and both paths now derive from the measured width via a single
+  `Viewport` (§2 Resolution); the 1280 literal is gone from `loki-text`.
+- **Error handling is already disciplined.** Genuine library-runtime
+  `unwrap()`/`expect()` was only **11 sites** (A-5), all safe-by-construction —
+  now all rewritten and locked by `clippy::unwrap_used`/`expect_used` in CI;
+  `panic!` in lib code is 0 (A-6); ad-hoc `Box<dyn Error>`/`String` errors are
+  effectively absent (A-10). `thiserror` is the norm.
+- **One real layering violation (A-8) — now fixed:** `loki-renderer` (render
+  layer) imported `appthere_ui` (ui layer) for two design tokens — a single
+  uphill edge, now removed (tokens injected via props; dep dropped). The UDOM
+  waist already held (no format crate leaks into layout/render), so the graph is
+  now fully downhill and gated.
+- **Two clean, mechanical hygiene gaps:** `loki-opc`'s SPDX headers are present
+  but on line 2 with one test file missing a header (A-3 — see the **correction
+  note** in §3.5; the original "26 files missing" was a false positive), and 11
+  stray root files (`scratch.rs` + 10 debug dumps, A-4, now removed); 38
+  production files exceed the 300-line ceiling (A-2, already tracked in
+  `docs/audit-2026-06.md`).
+- **Enforcement is the actual deliverable.** *At audit time*, CI ran only `cargo
+  fmt --check` + default `clippy -D warnings` + build/test. **Since then** nine
+  structural gates have landed (see §4): license-header, panic-guard,
+  unsafe-policy, file-ceiling, TODO-format, `unwrap_used`/`expect_used`,
+  dependency-direction, and the viewport-dimension guard. The only documented
+  residuals are the `clippy::pedantic` lint set and the full general-purpose
+  dylint (both out of reach of this stable-toolchain environment; §4).
+
+Net: this is a **gates-first** job, not a sweep. The smells are few and mostly
+mechanical; the value is in making them un-reintroducible (M3).
+
+---
+
+## 2. The 1280px class — dedicated trace (§4.2) — ✅ resolved
+
+### 2.1 Every hardcoded viewport/page/window dimension
+
+`git grep` for the literal `1280` across non-test, non-patch `.rs` yields exactly
+**two** hits, and both point at the same root:
+
+| Location | Code | Role |
+|---|---|---|
+| `loki-text/src/routes/editor/editor_state.rs:177` | `window_width: use_signal(\|\| 1280.0_f32)` | **The source.** Default never overwritten. |
+| `loki-text/src/editing/hit_test.rs:17` | `//! window_inner_width_px defaults to 1280 px` | Doc comment acknowledging the assumption. |
+
+The *consequences* fan out through the centring formula
+`(window_width − page_width_px) / 2.0` (pages are flex-centred), duplicated at:
+
+| Location | Expression |
+|---|---|
+| `editor_pointer.rs:41` | `((window_width − client_width_px) / 2.0).max(0.0)` |
+| `editor_pointer.rs:98` | `(window_width() − page_width_px).max(0.0) / 2.0` |
+| `editor_pointer.rs:167` | `(window_width() − page_width_px).max(0.0) / 2.0` |
+| `editor_pointer.rs:260` | `(window_width() − page_width_px).max(0.0) / 2.0` |
+| `editor_spell_panel.rs:51` | `(window_width − MENU_WIDTH_PX − EDGE_MARGIN_PX).max(0.0)` |
+| `hit_test.rs:16` (doc) | `canvas_origin.x = (window_inner_width_px − page_width_px) / 2.0` |
+
+Adjacent magic-dimension literals found in the same scan (lower-severity, but in
+the same class — a numeric literal in a layout/render path that is neither a
+named `const` nor viewport-sourced):
+
+| Location | Literal | Note |
+|---|---|---|
+| `editor_canvas.rs:383` | `if h > 1.0 { h } else { 800.0 }` | Fallback page height; magic. |
+| `loki-spreadsheet/.../editor_inner.rs:74` | `const MAX_COL_PX: f64 = 800.0` | Named, but app-local; fine. |
+| `docx/mapper/document.rs:488-489` | `header: 720, footer: 720` | Twips (½ inch) — intrinsic OOXML default, **legitimate**; should carry a named const + comment. |
+| `presentation-model/presentation.rs:39` | `STANDARD_4_3 = Size::new(720.0, 540.0)` | Named const — **legitimate** intrinsic. |
+
+### 2.2 Origin & what *should* supply the value
+
+The mechanism (confirmed by reading the code, not inferred):
+
+1. `window_width` is initialised to `1280.0` and there is **no writer** anywhere
+   in `loki-text/src` — `git grep 'window_width\.set\|window_width ='` returns
+   only the `use_signal` initialiser and read sites.
+2. The editor *does* measure the real viewport: `editor_inner.rs:612` awaits
+   `evt.get_client_rect()` and stores `rect.size.width` into
+   `scroll_metrics.client_width` (`editor_canvas.rs:250`,
+   `editor_inner.rs:615`). That measured width feeds `reflow_width_px`
+   (`editor_canvas.rs:394`) — i.e. **rendering and reflow already use the real
+   width.**
+3. Hit-test / pointer / spell-panel math instead reads the *stale* `window_width`
+   signal. So the rendered page is centred using the measured width while the
+   click-to-caret transform assumes 1280 — they agree only when the window
+   happens to be 1280 px wide.
+
+**What should supply the value:** the live measured viewport width
+(`scroll_metrics.client_width`), the page geometry (`tokens::PAGE_WIDTH_PX` /
+`state.page_width_px`), the zoom state, and DPI — bundled into **one**
+`Viewport` / `LayoutContext` value threaded through render *and* hit-test, with a
+single `canvas_origin_x()` helper replacing the six duplicated centring
+expressions. This is **D4** of the spec and the precondition for Spec 03
+(Responsive). It is also the sanctioned alternative the `no_hardcoded_layout_dims`
+dylint (§6.2) must point authors toward.
+
+> **Resolution (✅ A-1 / A-14, 2026-06-28).** The `window_width` signal (and its
+> 1280 default) is **deleted**. A new `loki-text/src/editing/viewport.rs`
+> introduces `Viewport { inner_width_px }` with `centred_origin_x(content_width)`,
+> built from the *measured* `scroll_metrics.client_width` at each use. The page
+> (paginated) and the reflow tile now centre on the **real** measured width — so
+> hit-testing and rendering use the same value and can no longer diverge — and
+> the six copied centring expressions collapse to one helper (closing A-14's
+> remaining half). Verified by `cargo test -p loki-text` (incl. 4 new
+> `Viewport` unit tests). Page geometry stays in `DocumentState`; zoom/DPI can
+> join `Viewport` when Spec 03 needs them. The `no_hardcoded_layout_dims` dylint
+> (§6.2, A-13) remains the future backstop against re-introducing such a literal.
+
+---
+
+## 3. Smell inventory by category (§4.1)
+
+### 3.1 Hardcoded dimensions / magic numbers — see §2 (A-1).
+
+### 3.2 Leaked `unwrap()` / `expect()` / `panic!` (A-5) — ✅ resolved
+
+Raw production counts (after stripping `#[cfg(test)]` modules): **20 `unwrap()`,
+21 `expect()`, 3 `panic!`**. But categorising each by *where it actually lives*
+deflates the genuine risk sharply (and the `panic!` row is A-6, resolved
+separately):
+
+| Bucket | Count | Verdict |
+|---|---|---|
+| Doc-comment examples (`//! … .unwrap()`) | ~6 | Acceptable; gate must exempt doc-tests. |
+| `build.rs` (`env::var(...).unwrap()`) | 6 | Build scripts — conventional, not library code. |
+| `benches/` `panic!` | 3 | Bench harness — test-equivalent, exempt. |
+| `Box<dyn Iterator>` / doc `Box<dyn Error>` | 3 | False positives (not error handling). |
+| **Genuine library-runtime `unwrap()`** | **~7** | Safe-by-construction; see below. |
+
+The genuine library `unwrap()`s, all guarded by a local invariant rather than
+reachable from untrusted input:
+
+- `loki-opc/src/part/name.rs:110`, `relationships/location.rs:17,22` —
+  `PartName::new_unchecked(format!(...)).unwrap()` on strings known-valid by
+  construction.
+- `loki-opc/src/zip/read.rs:120,122` — `strip_suffix(".rels").unwrap()` guarded
+  by a prior `.ends_with(".rels")`.
+- `loki-opc/src/package.rs:174` — `core_properties.as_mut().unwrap()` after an
+  ensured insert.
+- `loki-ooxml/src/xlsx/export.rs:371` — `rows.remove(&r).unwrap()` on a key just
+  proven present.
+
+(The original draft also listed `loki-doc-model/src/loro_bridge/comments.rs:94`
+and two `loro_bridge` `expect`s, plus `loki-spreadsheet`/`loki-templates`
+`expect`s; the precise clippy re-scan in the Resolution below showed those are
+`#[cfg(test)]` code, a custom parser `expect()` method, or a `src/bin`/`build.rs`
+tool — not library runtime. The two `loki-layout` and two `loki-i18n` sites it
+*did* confirm are folded into the 11 below.)
+
+**Resolution (✅ A-5).** A precise re-scan with clippy's own
+`clippy::unwrap_used` / `clippy::expect_used` (which target `Option`/`Result`
+exactly — no false positives on the `loki-spreadsheet` parser's custom `expect()`
+method) found **exactly 11 genuine first-party library sites**; the earlier
+`loro_bridge` "hits" were `#[cfg(test)]` code. **All 11 were eliminated by
+rewriting** — no library `#[allow]` was needed:
+
+- `loki-opc` (×6): `core_properties_mut` → `get_or_insert_with`; the
+  `strip_suffix(".rels")` pair → `unwrap_or` (+ a redundant `if/else` collapsed);
+  and `PartName::new_unchecked` made **infallible** (`-> Self`; it was
+  `Ok(Self(s))` — a vestigial `Result`), removing all three `.unwrap()`s.
+- `loki-ooxml/src/xlsx/export.rs` → `let … else { continue }`.
+- `loki-layout/src/lib.rs` → a `match groups.last_mut()`; `para.rs` → bind the
+  band via `band.as_ref().filter(…)` (the band type isn't `Clone`, so
+  `layout_band_body` now borrows it).
+- `loki-i18n` (×2) → a compile-time `langid!("en-US")` helper (no runtime parse).
+
+Enforcement: `clippy::unwrap_used` + `clippy::expect_used` are now denied in CI
+(`rust.yml`); `clippy.toml` exempts `#[cfg(test)]`/`#[test]` code
+(`allow-unwrap-in-tests`/`allow-expect-in-tests`). Build scripts and the
+`gen_templates` codegen bin carry a justified file-level `#![allow(…)]` (a panic
+there aborts the build/tool, not runtime). Baseline is **green**.
+
+### 3.3 `unsafe` blocks (A-7) — ✅ resolved
+
+Exactly the three documented Android `NativeActivity` crates contained `unsafe`:
+`loki-text`, `loki-presentation`, `loki-spreadsheet` (`src/lib.rs`), all in the
+`android_main` FFI entry point. **No undocumented `unsafe` existed** in
+production crates. The gap was structural: those three crates *omitted*
+`#![forbid(unsafe_code)]` entirely (because `#[unsafe(no_mangle)]` on
+`android_main`, Rust 2024, makes `forbid` impossible) rather than scoping the
+exception.
+
+**Resolved** (jointly with A-14): each crate root is now `#![deny(unsafe_code)]`,
+and the single unsafe item — the macro-generated `android_main` — carries a
+scoped `#[allow(unsafe_code)]` (emitted by `loki_app_shell::android_main!`). The
+three crates are enumerated in `scripts/unsafe-policy-allowlist.txt`, and
+`scripts/check-unsafe-policy.py` (CI) verifies every crate root is `forbid`, or
+`deny` + allow-listed — so a fourth unsafe crate cannot appear silently.
+
+### 3.4 File-ceiling violations (A-2) — ✅ gated; 3 split, 35 baselined
+
+**38 production `.rs` files** exceeded 300 lines (excluding `tests/`, `*_tests.rs`,
+and `patches/`; one further 300+ file — `odt/mapper/props/tests.rs` — is a test
+file and exempt). Worst offenders:
+
+| Lines | File |
+|---|---|
+| 1982 | `loki-layout/src/para.rs` |
+| 1953 | `loki-layout/src/flow.rs` |
+| 1554 | `loki-odf/src/odt/reader/styles.rs` |
+| 1494 | `loki-odf/src/odt/reader/document.rs` |
+| 1244 | `loki-spreadsheet/src/routes/editor/editor_inner.rs` |
+| 1209 | `loki-ooxml/src/docx/reader/document.rs` |
+| 1073 | `loki-ooxml/src/docx/write/document.rs` |
+| 1046 | `loki-text/src/routes/editor/editor_inner.rs` |
+| 984 | `loki-layout/src/resolve.rs` |
+| 948 | `loki-vello/src/scene.rs` |
+
+This overlaps the existing split-pass backlog in `docs/audit-2026-06.md`
+(finding Q-1) and the CLAUDE.md tech-debt table.
+
+**Resolution.** The enforcement is now live: `scripts/check-file-ceiling.py`
+(CI) is a **ratchet** against `scripts/file-ceiling-baseline.txt` — a new file
+must be ≤300 lines, a baselined file may not *grow*, and a baselined file that
+drops to ≤300 must leave the list (so the backlog can only shrink). As an
+immediate down-payment, the **3 files that were over-ceiling solely because of a
+large inline `#[cfg(test)]` module** were split via the safe inline-test
+extraction idiom (`#[path]` sibling, zero production-code change):
+`loki-text/src/editing/hit_test.rs` (561→197), `loki-ooxml/src/xml_util.rs`
+(363→188), `loki-pdf/src/page.rs` (322→218) — all verified by `cargo test`. The
+baseline now holds the remaining **35**; the genuinely large files (e.g.
+`para.rs` 1982, `flow.rs` 1953) remain the maintainer's directory-split backlog,
+but they can no longer grow.
+
+### 3.5 SPDX header issues (A-3, A-4)
+
+> **Correction (2026-06-28).** The original finding here — "27 production files
+> lack the Apache-2.0 SPDX header entirely," all of `loki-opc/src/` — was a
+> **false positive**. The audit script matched only the literal string
+> `Apache-2.0`; `loki-opc` is **MIT-licensed** (it will be released standalone —
+> see [`0010-per-crate-licensing.md`](0010-per-crate-licensing.md)) and its files
+> **do** carry `// SPDX-License-Identifier: MIT`. The real, narrower issues were:
+> (1) `loki-opc` placed the SPDX id on **line 2** (copyright on line 1),
+> violating the SPDX-on-line-1 convention and the ordering every Apache crate
+> uses; and (2) `loki-opc/tests/package_tests.rs` genuinely had **no** header.
+> Both are now **resolved**: the 27 files were reordered to SPDX-on-line-1, the
+> test file got its header, and a license-aware gate
+> (`scripts/check-license-headers.py`, wired into CI) checks each file's line-1
+> SPDX id against its crate's `Cargo.toml` `license`. The corrected finding is
+> recorded below.
+
+**Actual A-3:** `loki-opc` (MIT) had its SPDX id on line 2 in 27 files and one
+test file (`tests/package_tests.rs`) had no header. Every other first-party crate
+(Apache-2.0) already carries `// SPDX-License-Identifier: Apache-2.0` on line 1.
+**Zero files** anywhere had a *wrong-license* header. The fix was a comment-only
+reorder + one insertion; the `spdx_header_line_one` gate (§6.2) is generalised to
+*the crate's* license (not a blanket Apache-2.0) so the MIT/Apache split is
+enforced, not just the presence of a header.
+
+### 3.6 Inconsistent error handling (A-10) — ✅ verified
+
+The **core library crates are `thiserror`-clean** (19 of 25 crates declare
+`thiserror`; format/model/layout all use typed enums). The only `Box<dyn …>`
+matches are a `Box<dyn Iterator>` (`loki-layout/src/result.rs:55`, not an error
+type) and a `Box<dyn std::error::Error>` inside a doc example
+(`docx/mapper/mod.rs:259`).
+
+A closer follow-up scan (test-module-stripped) found **three** `Result<_,
+String>` holdouts — all *outside* the core libraries, so the original "essentially
+clean" claim for the libraries holds:
+
+- `loki-acid/src/fixtures.rs:120`, `golden.rs:72` — the **ACID test/dev harness**,
+  where `String` diagnostics are an accepted bar (test code is exempt from the
+  typed-error convention).
+- `loki-presentation/src/routes/editor/editor_save.rs:20` —
+  `export_to_token() -> Result<(), String>`, **deliberately UI-facing** (its doc
+  says "Returns a human-readable error string"); its two callers display the
+  string in the editor.
+
+**Disposition:** verified — no remediation in the core libraries is needed. The
+one product-crate holdout (`editor_save`) is a candidate to convert to a typed
+`SaveError` (Display-preserving, two callers) in a Presentation-app pass; left as
+a noted residual rather than refactoring app error handling on this branch.
+Mechanised enforcement rides with the deferred clippy `disallowed-types` gate
+(A-13), scoped to library crates.
+
+### 3.7 Dead / unreachable code (A-4) — ✅ resolved
+
+- **`scratch.rs`** (root, a throwaway Dioxus API probe, not a workspace member)
+  — **removed**.
+- Root-level stray artifacts — `diff_flow.txt`, `iris.png`, `iris_output.png`,
+  `iris_stderr.log`, `output.png`, `test_output.{png,txt}`, `test_output_utf8.txt`,
+  `test_log.txt`, `test_log_utf8.txt` (committed debug/render dumps; the
+  `render_to_png` example writes `./output.png`) — **removed** after confirming
+  no tracked code/README references them, and **`.gitignore` entries added** so
+  they can't drift back in.
+- A deeper dead-`pub` / orphaned-module sweep needs `cargo +nightly udeps` /
+  `warnings(dead_code)` over an `--all-features` build and is **deferred** to a
+  fix-pass with the gate live (honest scope note: not exhaustively done here).
+
+### 3.8 Duplication (A-14) — ✅ resolved (both clusters)
+
+- **The centring formula** (§2.1) — six near-identical copies of `(window_width −
+  …)/2.0` — now collapse to the single `Viewport::centred_origin_x()` helper,
+  resolved jointly with A-1 (see §2 Resolution).
+- **Android `android_main` entry point** — was ~55 lines duplicated near-verbatim
+  across all three app crates (only the logcat tag and the `init_android`
+  argument differed). **Resolved:** extracted into a `loki_app_shell::android_main!`
+  macro (`loki-app-shell/src/android.rs`); each crate now invokes it in one line.
+  A *macro* (not a function) keeps the `dioxus`/`blitz_shell`/`android_activity`
+  deps in the binaries — `loki-app-shell` gains no deps and stays
+  `#![forbid(unsafe_code)]` (the emitted `unsafe` lands in the caller, where A-7's
+  scoped allow lives). The three near-divergent copies were unified to one
+  canonical body (presentation/spreadsheet gain one extra insets-log line —
+  benign). **Verification note:** the `android_main` body is entirely
+  `#[cfg(target_os = "android")]`, so it cannot be compiled in this GPU-less Linux
+  CI/agent environment; the non-Android build (`cargo check` of all three crates
+  + app-shell) passes and the macro expansion/cfg-stripping is validated there,
+  but the **Android target build is unverified here** — the maintainer should run
+  `scripts/build-aab.sh` before relying on it.
+
+### 3.9 `HACK` / `TODO` / `FIXME` / `XXX` debt (A-11) — ✅ inventoried + gated
+
+Production (non-test, non-patch): **47 `// TODO`**, **57 `// COMPAT`**, **0
+`HACK`/`FIXME`/`XXX`**. **All 47 TODOs already carry a `TODO(<topic>)` tag** (0
+bare) — the discipline is already there. **Resolution:** catalogued in
+[`spec-01-todo-compat-inventory.md`](spec-01-todo-compat-inventory.md) (TODOs
+grouped by topic; the 57 `COMPAT`s grouped by target — 32 are
+`COMPAT(dioxus-native)`, the set to re-validate when the Dioxus `=0.7.9` pin
+moves). `scripts/check-todo-format.py` (CI) now fails on any bare `// TODO` or any
+`FIXME`/`HACK`/`XXX`, so the tagging can't decay. `COMPAT` markers are sanctioned
+and not removed.
+
+### 3.10 Naming inconsistency (A-12) — ✅ decided (no rename)
+
+Mostly consistent: import/export config is uniformly `*Options`
+(`OdtImportOptions`, `XlsxImportOptions`, `LayoutOptions`, `PdfXOptions`,
+`EpubOptions`, …). The one real divergence:
+
+- **`*Props` is overloaded.** It means both Dioxus *component* props
+  (`AtTitleBarProps`, `DocumentViewProps`, …) **and** document-model *formatting
+  property bags* (`ParaProps`, `CharProps`, `RunProps`, `CellProps`,
+  `TableProps`, `ShapeProps`). **Decision (✅, [`0011`](0011-props-naming-convention.md)):
+  keep both — do not rename.** They live in disjoint crates/module paths
+  (`loki_doc_model::style::props::*` vs. the UI components), never collide, and
+  the model bags mirror OOXML's `pPr`/`rPr` vocabulary. The proposed rename is
+  **350+ references across 66+ files** touching the CRDT bridge and every format
+  mapper — disproportionate to a low-priority, namespace-disambiguated cosmetic
+  concern. The rename remains available as its own reviewed PR on request.
+- Minor: `DocxSettings` / `DocumentSettings` use `*Settings` where `*Options`
+  is the norm — but `DocxSettings` maps to the OOXML `settings.xml` part, so the
+  name is domain-justified. Leave as-is.
+
+### 3.11 Layering violations (A-8, A-9) — ✅ resolved
+
+Computed from `cargo metadata` against the target layers (full analysis in
+[`0009-target-architecture.md`](0009-target-architecture.md)):
+
+- **A-8 — `loki-renderer` → `appthere_ui` (uphill render→ui). ✅ Fixed.** The
+  single edge existed only for two design-token constants (`PAGE_GAP_PX`,
+  `SPACE_6`) read in `document_view.rs`. They are now **injected** into
+  `DocumentViewProps` (`page_gap_px`, `content_padding_bottom_px`) by the app —
+  which legitimately depends on `appthere_ui` — and the `appthere-ui` dependency
+  is dropped from `loki-renderer/Cargo.toml`. Verified by `cargo check -p
+  loki-renderer`. The workspace graph is now fully downhill.
+- **A-9 — `loki-pdf` → `loki-layout` (classification, not a violation).** Resolved
+  by ADR-0009's L3b exporter-above-layout tier (`loki-pdf` above layout;
+  `loki-epub` in the L2 waist) — see §3.8 and [`0009`](0009-target-architecture.md).
+
+No `model → render/layout/ui` edges exist; foundation crates remain leaves;
+`loki-odf`/`loki-ooxml` do not leak into layout/render. The architecture is now
+**clean** — enforced by the dependency-direction gate (A-13).
+
+---
+
+## 4. Enforcement gap (A-13) — ✅ substantially closed
+
+| Convention claimed (CLAUDE.md / spec §6) | Enforced today? |
+|---|---|
+| `cargo fmt` | ✅ CI (`rust.yml` `fmt --check`) |
+| `clippy -D warnings` (default lints) | ✅ CI |
+| `clippy::pedantic` + curated allow-list | ❌ no `[workspace.lints]` (remaining; see below) |
+| No `panic!`/`todo!`/`unimplemented!` in lib code | ✅ CI (`scripts/check-no-panics.py`, A-6) |
+| No `unwrap`/`expect` in lib code | ✅ CI (`clippy::unwrap_used`/`expect_used` + `clippy.toml` test exemption, A-5) |
+| `TODO(<topic>)` tags, no FIXME/HACK/XXX | ✅ CI (`scripts/check-todo-format.py`, A-11) |
+| 300-line file ceiling | ✅ CI (`scripts/check-file-ceiling.py` ratchet + baseline, A-2) |
+| SPDX header on line 1 (per-crate license) | ✅ CI (`scripts/check-license-headers.py`, ADR-0010) |
+| `forbid(unsafe_code)` + enumerated exceptions | ✅ CI (`scripts/check-unsafe-policy.py` + allow-list, A-7) |
+| Acyclic downhill-only deps | ✅ CI (`scripts/check-dependency-direction.py` vs ADR-0009, A-13) |
+| `no_hardcoded_layout_dims` (1280 class) | ✅ CI guard (`scripts/check-no-hardcoded-viewport-dims.py`); full dylint deferred (see below) |
+
+CI = `.github/workflows/rust.yml`: the lint job now runs **nine** structural
+gates ahead of fmt/clippy/build-test.
+
+**Two deliberate residuals.**
+
+1. **`clippy::pedantic` workspace lint set (§6.1).** Not enabled. Turning on
+   `pedantic` across 25 crates produces a large, noisy initial diff and needs a
+   curated `[workspace.lints]` allow-list (per-crate opt-in × 25). It is a
+   self-contained future pass; the high-value restriction lints
+   (`unwrap_used`/`expect_used`) are already on.
+2. **The `no_hardcoded_layout_dims` *dylint* (§6.2).** A true dylint does
+   AST-level analysis on a pinned nightly via the dylint driver —
+   infrastructure not present in this stable-toolchain CI, and fragile to
+   maintain. The **specific 1280 class it targets is already eliminated** (A-1),
+   and `scripts/check-no-hardcoded-viewport-dims.py` now blocks its
+   re-introduction in the editor input/viewport hot-paths (with a named-`const`
+   escape hatch). The general-purpose dylint remains a deferred specialist task,
+   honestly out of reach of this environment.
+
+---
+
+## 5. Triage table (§4.3) — Priority left blank for maintainer (D1)
+
+| ID | Category | Location(s) | Count | Blast radius | Proposed fix | Priority |
+|----|----------|-------------|-------|--------------|--------------|----------|
+| A-1 | Hardcoded viewport dim (1280 class) | `editor_state.rs:177`; `editor_pointer.rs` ×4; `hit_test.rs`; `editor_spell_panel.rs` | 1 source + 6 derived | **Medium** — `loki-text` input/hit-test; behaviour-affecting | ✅ **Done** — `window_width`/1280 deleted; new `editing::viewport::Viewport` (measured `scroll_metrics.client_width`) + `centred_origin_x()`; hit-test & render now share the measured width (D4) | **Resolved** |
+| A-2 | File-ceiling >300 | 38 production files (`para.rs` 1982 … `scene.rs` 948) | 38 | **Large but mechanical** | ✅ **Gated + down-payment** — ratchet gate (`check-file-ceiling.py` + baseline); 3 split via inline-test extraction (38→35); 35 frozen, can't grow | **Partial** |
+| A-3 | SPDX line-1 / per-crate license | `loki-opc` (MIT) SPDX on line 2 ×27 + `tests/package_tests.rs` missing | 28 | **Small** | ✅ **Done** — reorder to SPDX-line-1, add missing header, MIT `LICENSE`, license-aware CI gate (ADR-0010) | **Resolved** |
+| A-4 | Dead/stray file | `scratch.rs` (+ 10 root debug dumps) | 11 | **Small** | ✅ **Done** — `git rm` all 11; `.gitignore` entries added to prevent recurrence | **Resolved** |
+| A-5 | Library `unwrap`/`expect` | 11 genuine (loki-opc ×6, loki-ooxml ×1, loki-layout ×2, loki-i18n ×2) | 11 | **Small** | ✅ **Done** — all 11 rewritten (0 library `#[allow]`); `clippy::unwrap_used`/`expect_used` denied in CI + `clippy.toml` test exemption | **Resolved** |
+| A-6 | `panic!` in production | 0 in lib src (3 in `benches/`); 7 documented `unreachable!` | 0 | n/a | ✅ **Done** — `scripts/check-no-panics.py` gate (forbids `panic!`/`todo!`/`unimplemented!` in lib src; allows messaged `unreachable!`), wired into CI | **Resolved** |
+| A-7 | `forbid(unsafe_code)` absent | `loki-text`, `loki-presentation`, `loki-spreadsheet` `lib.rs` | 3 (expected) | **Small** | ✅ **Done** — `#![deny(unsafe_code)]` + macro-emitted scoped `#[allow]`; `unsafe-policy-allowlist.txt` + `check-unsafe-policy.py` CI gate | **Resolved** |
+| A-8 | Layering: render→ui (uphill) | `loki-renderer/src/document_view.rs:9` | 1 edge | **Small–Medium** | ✅ **Done** — 2 tokens injected via `DocumentViewProps`; `appthere-ui` dep dropped from `loki-renderer`; dep-direction gate enforces | **Resolved** |
+| A-9 | Layering classification | `loki-pdf` → `loki-layout` | 1 | **None (doc)** | ✅ **Done** — L3b exporter-above-layout tier documented in [`0009`](0009-target-architecture.md) (refinement #1); `loki-epub` stays L2, `loki-pdf` L3b | **Resolved** |
+| A-10 | Inconsistent error handling | core libs clean; 3 `Result<_,String>` holdouts (2 test-harness, 1 UI-facing app glue) | 3 | **None** | ✅ **Verified** — no core-lib remediation needed; residuals noted (§3.6); enforcement rides with the deferred clippy `disallowed-types` gate (A-13) | **Resolved** |
+| A-11 | TODO/COMPAT debt | 47 TODO (all tagged) / 57 COMPAT (prod) | 104 | **Medium (process)** | ✅ **Done** — inventory doc; `check-todo-format.py` gate (CI); COMPATs grouped for Dioxus-pin re-validation | **Resolved** |
+| A-12 | Naming: `*Props` overloaded | model bags vs Dioxus props | ~6 model bags | **Medium (rename)** | ✅ **Decided ([0011](0011-props-naming-convention.md))** — keep `*Props`; rename (350+ refs) disproportionate, available on request | **Resolved** |
+| A-13 | Enforcement gap | `clippy.toml`, ceiling/SPDX/dep-direction gates, dylint all absent | — | **Foundational** | ✅ **Substantially done** — 9 CI gates live (§4); residuals: `clippy::pedantic` set + general dylint (both documented, out-of-env) | **Resolved** |
+| A-14 | Duplication | centring math (A-1); `android_main` ×3 | 2 clusters | **Small–Medium** | ✅ **Done** — `android_main` → `loki_app_shell::android_main!` macro; centring math → `Viewport::centred_origin_x()` (with A-1) | **Resolved** |
+
+---
+
+## 6. Raw dependency graph (input to M2)
+
+Internal `normal`-kind edges from `cargo metadata --no-deps` (25 crates):
+
+```
+appthere-canvas        -> loki-render-cache
+appthere-ui            -> loki-i18n
+loki-app-shell         -> loki-i18n, loki-spell
+loki-doc-model         -> loki-primitives
+loki-epub              -> loki-doc-model, loki-primitives
+loki-graphics          -> loki-primitives
+loki-layout            -> loki-doc-model, loki-fonts, loki-primitives, loki-spell
+loki-odf               -> loki-doc-model, loki-primitives, loki-sheet-model
+loki-ooxml             -> loki-doc-model, loki-graphics, loki-opc,
+                          loki-presentation-model, loki-primitives, loki-sheet-model
+loki-pdf               -> loki-doc-model, loki-layout, loki-primitives
+loki-presentation      -> appthere-ui, loki-app-shell, loki-doc-model, loki-fonts,
+                          loki-graphics, loki-i18n, loki-layout, loki-odf, loki-ooxml,
+                          loki-presentation-model, loki-renderer, loki-vello
+loki-presentation-model-> loki-graphics
+loki-renderer          -> appthere-canvas, appthere-ui, loki-doc-model,
+                          loki-layout, loki-vello          # appthere-ui = A-8 uphill
+loki-sheet-model       -> loki-primitives
+loki-spreadsheet       -> appthere-ui, loki-app-shell, loki-doc-model, loki-fonts,
+                          loki-i18n, loki-layout, loki-odf, loki-ooxml, loki-renderer,
+                          loki-sheet-model, loki-vello
+loki-templates         -> loki-doc-model, loki-ooxml, loki-primitives
+loki-text              -> appthere-ui, loki-app-shell, loki-doc-model, loki-epub,
+                          loki-fonts, loki-i18n, loki-layout, loki-odf, loki-ooxml,
+                          loki-pdf, loki-renderer, loki-templates, loki-vello
+loki-vello             -> appthere-canvas, loki-layout
+```
+
+Leaves (no internal deps): `loki-primitives`, `loki-fonts`, `loki-i18n`,
+`loki-spell`, `loki-opc`, `loki-render-cache`. The graph is **acyclic**; the only
+uphill edge against the target layering is `loki-renderer → appthere-ui` (A-8).
+
+---
+
+## 7. Acceptance check against M1 (§8)
+
+- ✅ Every crate inspected (25/25; quantitative scans cover all 664 tracked `.rs`).
+- ✅ All §4.1 categories surfaced and counted.
+- ✅ Dedicated 1280px-class trace (§2) with origin + single-source-of-truth proposal.
+- ✅ Raw dependency graph produced (§6).
+- ✅ Triage table populated **except** the Priority column (D1).
+- ✅ **No code changed** — read-only pass.
+
+**Next:** maintainer fills Priority → M3 (enforcement gates land first, D2) →
+M4 (fixes top-down, `Viewport` replaces the 1280 class). The deferred items
+honestly flagged above (exhaustive dead-`pub` sweep §3.7; root-artifact triage
+§3.7) are called out rather than silently skipped.
diff --git a/docs/adr/spec-01-codebase-audit-and-architecture.md b/docs/adr/spec-01-codebase-audit-and-architecture.md
new file mode 100644
index 00000000..ec09d4f1
--- /dev/null
+++ b/docs/adr/spec-01-codebase-audit-and-architecture.md
@@ -0,0 +1,203 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 01 — Codebase Audit & Target Architecture
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation |
+| **Scope** | AppThere Loki (Text), with monorepo-wide enforcement primitives |
+| **Sequence** | 1 of 6 — foundational; other specs conform to the architecture this one establishes |
+| **Depends on** | Nothing |
+| **Feeds** | Testing harness (gates), Responsive (kills layout hardcodes), Ribbon, Styling Panel, Benchmarking (shares CI infra) |
+
+---
+
+## 1. Context & Motivation
+
+The majority of Loki-specific code is AI-generated. Much of it works, but not every decision was intentional or sound, and incidental shortcuts have begun to ossify into load-bearing assumptions. The canonical example: hit-detection in the Vello document renderer works around a hardcoded **1280px window width** that resurfaces in multiple places despite the app being nominally responsive. That number is a *temporary decision that became permanent* because nothing in the toolchain objects to it.
+
+This spec does two things, in order:
+
+1. **Audit** the entire codebase to surface incidental, inconsistent, or unsound decisions — magic numbers, leaked `unwrap()`s, hardcoded dimensions, dead code, inconsistent error handling, layering violations — and present them for triage rather than pre-judging severity.
+2. **Establish enforcement** so that once a smell is fixed, the toolchain prevents its return. The goal is not a one-time sweep; it is making the conventions *mechanically un-violable* in CI.
+
+A third, dependent output: the audit **proposes a clean target architecture** derived from what already exists and what is reasonably reachable from the current state — not an idealized rewrite. Every subsequent spec conforms to that architecture.
+
+This is an **audit-first, implement-second** task. The implementing agent inspects the live codebase before proposing or changing anything; the file and crate references in this document are illustrative, not authoritative, and may be stale.
+
+---
+
+## 2. Goals / Non-Goals
+
+**Goals**
+
+- Produce a complete, triageable inventory of code smells and architectural inconsistencies.
+- Propose a target layering and crate-dependency invariant grounded in the existing crate graph.
+- Implement enforcement (lints + CI gates) for every convention Loki already claims to hold.
+- Eliminate the specific class of bug the 1280px hardcode represents: layout/render logic that assumes a fixed viewport.
+
+**Non-Goals**
+
+- Rewrites. Fixes are intentional and incremental; the architecture is *reachable*, not aspirational.
+- Behavioral feature work. This spec changes structure and removes incidental decisions; it does not add user-facing features.
+- Performance optimization (owned by Spec 06 — Benchmarking) beyond removing obviously wasteful incidental code the audit surfaces.
+- Fixing every smell in one pass. The audit *surfaces and triages*; fixes are scheduled against the ranked list.
+
+---
+
+## 3. Working Method (for the implementing agent)
+
+Follow the established Fix Session discipline:
+
+1. **Audit pass — read only.** Inspect every crate. Produce the inventory in §4. Change nothing.
+2. **Triage.** Present the inventory as a ranked table (§4.3) for the maintainer to confirm/reorder priority. Do not assume severity ordering.
+3. **Architecture proposal.** Produce §5 as a standalone ADR within this document's companion set, validated against the real dependency graph.
+4. **Enforcement.** Implement §6 (lints + CI gates). These land *before* the bulk of fixes, so fixes are verified by the gates as they're made.
+5. **Fixes.** Work the triaged list top-down, one ADR per non-trivial decision, each with tradeoffs recorded.
+
+Standing standards assumed everywhere (flag any deviation found, do not silently conform):
+300-line file ceiling · no `unwrap()`/`expect()` in library code · `#![forbid(unsafe_code)]` at crate roots (documented exceptions only) · typed errors via `thiserror` · Apache-2.0 SPDX header on line 1 · Rust 2024 edition.
+
+---
+
+## 4. The Audit
+
+### 4.1 Smell categories to surface
+
+The audit inspects for at least the following. It **surfaces and counts**; it does not pre-rank.
+
+- **Hardcoded dimensions / magic numbers** — the 1280px class. Any numeric literal in a layout, hit-test, or render code path that is not a named constant or sourced from a viewport/config value. Flag clusters where the same magic value recurs (strong signal of a leaked assumption).
+- **Leaked `unwrap()` / `expect()` / `panic!`** in library code, distinct from test-only usage (which is acceptable). Report path + whether reachable from a public API.
+- **`unsafe` blocks** outside the documented exceptions (Android `NativeActivity` in `loki-text`/`loki-presentation`/`loki-spreadsheet`). Each must carry a `// SAFETY:` justification; flag any that don't.
+- **File-ceiling violations** (>300 lines) with current line counts.
+- **SPDX header issues** — missing, or not on line 1.
+- **Inconsistent error handling** — ad-hoc `Box<dyn Error>`, `String` errors, or `Result` types not backed by a `thiserror` enum.
+- **Dead / unreachable code** — unused `pub` surface, orphaned modules, behind-`cfg` code that never compiles for any target.
+- **Duplication** — copy-pasted logic that should be a shared helper or crate (especially anything duplicated across the Text/Presentation/Spreadsheet members).
+- **`HACK` / `TODO` / `FIXME` / `XXX` debt** — catalogued with surrounding context so each can be converted to a tracked decision or resolved.
+- **Naming inconsistency** — divergent conventions for the same concept across crates (e.g. `*Props` vs `*Config` vs `*Options`).
+- **Layering violations** — any dependency that points "uphill" against the target architecture (§5). This category can only be fully populated after §5 is drafted; the audit produces the raw dependency graph first.
+
+### 4.2 The 1280px class — special handling
+
+This pattern is the named motivation, so it gets a dedicated sub-investigation. The agent must:
+
+1. Find **every** occurrence of a hardcoded viewport/page/window dimension across render, layout, and hit-test code.
+2. Trace each to its origin and document what *should* supply the value (live viewport, page geometry, zoom state, DPI).
+3. Propose the single source of truth that replaces them — a `Viewport`/`LayoutContext` type threaded through render and hit-test — so that the dylint in §6.2 has a sanctioned alternative to point authors toward.
+
+### 4.3 Deliverable format
+
+A markdown audit report committed alongside this spec, with a triage table the maintainer ranks:
+
+| ID | Category | Location(s) | Count | Blast radius | Proposed fix | Priority (maintainer) |
+|----|----------|-------------|-------|--------------|--------------|----------------------|
+
+"Blast radius" = how much code/behavior a fix touches, so triage can weigh effort against risk. The **Priority** column is left blank for the maintainer to fill.
+
+---
+
+## 5. Target Architecture (proposed by the agent)
+
+The agent proposes a layering derived from the *existing* crates, not an idealized one. The expected shape, to be confirmed and refined against reality:
+
+```
+                 ┌─────────────────────────────────────┐
+   app binary    │  loki (wires everything)            │
+                 └─────────────────────────────────────┘
+                 ┌─────────────────────────────────────┐
+   ui            │  loki ribbon / panels · appthere_ui │
+                 └─────────────────────────────────────┘
+                 ┌─────────────────────────────────────┐
+   render        │  loki-renderer (Vello/wgpu) ·       │
+                 │  appthere-canvas                    │
+                 └─────────────────────────────────────┘
+                 ┌─────────────────────────────────────┐
+   layout        │  pagination · text layout (Parley)  │
+                 └─────────────────────────────────────┘
+   ── UDOM waist ── narrow, format-neutral boundary ──
+                 ┌─────────────────────────────────────┐
+   io / serde    │  loki-odf · loki-opc · ooxml ·      │
+                 │  loro_bridge                        │
+                 └─────────────────────────────────────┘
+                 ┌─────────────────────────────────────┐
+   model         │  loki-doc-model · loki-sheet-model  │
+                 └─────────────────────────────────────┘
+                 ┌─────────────────────────────────────┐
+   foundation    │  loki-primitives · loki-fonts ·     │
+                 │  appthere-color                     │
+                 └─────────────────────────────────────┘
+```
+
+### 5.1 Invariants the audit validates
+
+- **Acyclic, downhill-only dependencies.** No crate depends on a layer above it. `model` never imports `render`, `layout`, or `ui`. `render` never imports `ui`.
+- **The UDOM waist.** Serialization (ODF/OOXML) talks to the model through a narrow, format-neutral document interface — the hourglass. Format-specific types do not leak upward into layout/render, and render types do not leak down into serialization.
+- **Foundation purity.** `loki-primitives`, `loki-fonts`, `appthere-color` depend on nothing internal except possibly each other in a fixed order; they are the leaves.
+- **`forbid(unsafe_code)` everywhere except the documented Android-`NativeActivity` crates**, and even there, scoped and `SAFETY`-justified.
+
+### 5.2 What the architecture ADR must contain
+
+For each proposed boundary: the rule, why it holds given current code, the violations the audit found against it, and the migration path to conformance. Where the current graph can't reach the target cheaply, the ADR says so and proposes the pragmatic intermediate state rather than forcing a costly move.
+
+---
+
+## 6. Enforcement
+
+Conventions that aren't mechanically enforced regress. Each gate below runs in CI and fails the build on violation.
+
+### 6.1 Clippy configuration
+
+- `clippy.toml` `disallowed-methods` for `Result::unwrap`, `Result::expect`, `Option::unwrap`, `Option::expect`, `panic!` **in library targets** (tests exempt via target config).
+- Workspace-level `#![deny(clippy::all, clippy::pedantic)]` with a curated, documented allow-list rather than blanket `allow`.
+
+### 6.2 Custom dylint lints
+
+- **`no_hardcoded_layout_dims`** — flags numeric literals above a small threshold appearing in render/layout/hit-test code paths that are neither named `const`s nor sourced from the sanctioned `Viewport`/`LayoutContext` type. This is the lint that makes the 1280px class un-reintroducible. It will need an allow-attribute escape hatch for genuinely intrinsic constants, each requiring a justifying comment.
+- **`spdx_header_line_one`** — fails if line 1 is not the Apache-2.0 SPDX header.
+
+### 6.3 CI shell gates
+
+- **300-line ceiling** — a script (ripgrep/`wc`) failing on any tracked `.rs` file over 300 lines, with an explicit, reviewed exceptions file if any file legitimately must exceed it.
+- **`forbid(unsafe_code)` presence** — verifies the attribute at each crate root except the named exceptions, which are themselves enumerated in a checked-in allow-list so new unsafe crates can't appear silently.
+- **Dependency-direction check** — parses the workspace graph (e.g. via `cargo metadata`) and fails on any uphill edge per §5.1. This is what keeps the architecture from eroding after Spec 01 lands.
+
+### 6.4 Relationship to other specs
+
+The schema-validation and round-trip gates are defined by **Spec 02 (Testing)** and plug into the same CI pipeline. Benchmark regression tracking (**Spec 06**) is local-only and explicitly *not* a CI gate. This spec owns only the structural/convention gates above.
+
+---
+
+## 7. Key Decisions (ADR-style)
+
+**D1 — Surface-and-triage, not pre-rank.** The audit reports counts and blast radius; the maintainer assigns priority. Rationale: severity depends on roadmap context the agent lacks. Tradeoff: an extra round-trip before fixes begin, accepted for correctness of prioritization.
+
+**D2 — Enforcement lands before bulk fixes.** Gates are implemented early so every subsequent fix is verified by them. Tradeoff: the codebase will be red against its own gates briefly; mitigated by an allow-list/baseline so CI can distinguish "known debt being worked" from "new violation."
+
+**D3 — Architecture is reachable, not ideal.** The proposed layering is derived from the existing graph; where the ideal is expensive, the ADR documents a pragmatic intermediate. Rationale: an unreachable target gets ignored.
+
+**D4 — Single viewport source of truth.** All layout/render/hit-test dimensions flow from one `Viewport`/`LayoutContext` value rather than literals. This is both a fix and the precondition for Spec 03 (Responsive). Tradeoff: threading the context through call sites is invasive; the dylint ensures it's worth doing once.
+
+---
+
+## 8. Milestones & Acceptance Criteria
+
+**M1 — Audit report.** Complete inventory across all §4.1 categories; dedicated 1280px-class trace (§4.2); raw dependency graph. *Accept:* every crate inspected; triage table populated except the Priority column; no code changed.
+
+**M2 — Architecture ADR.** Target layering + invariants (§5), validated against the real graph, with per-boundary violation lists and migration paths. *Accept:* maintainer can read the ADR and locate every current violation it claims.
+
+**M3 — Enforcement live.** §6 gates implemented and running in CI against a baseline/allow-list. *Accept:* introducing a fresh 1280-style literal, an over-ceiling file, a missing SPDX header, or an uphill dependency each fails CI in a test branch.
+
+**M4 — Triaged fixes.** Work the ranked list top-down; one ADR per non-trivial fix; the `Viewport` source-of-truth replaces the 1280px class. *Accept:* the allow-list/baseline shrinks toward empty; no gate regressions; existing 509 tests green (plus any added).
+
+---
+
+## 9. Out of Scope
+
+- New user-facing features.
+- Performance/memory optimization beyond removing incidental waste (→ Spec 06).
+- The responsive layout *behavior* itself (→ Spec 03); this spec only removes the hardcodes blocking it and establishes the `Viewport` type.
+- Schema-validation and round-trip test gates (→ Spec 02); this spec only reserves their slot in CI.
+- Presentation/Spreadsheet-specific audits beyond shared/duplicated code; each member app gets its own audit pass later, reusing the enforcement primitives this spec creates.
diff --git a/docs/adr/spec-01-todo-compat-inventory.md b/docs/adr/spec-01-todo-compat-inventory.md
new file mode 100644
index 00000000..eca794b5
--- /dev/null
+++ b/docs/adr/spec-01-todo-compat-inventory.md
@@ -0,0 +1,94 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 01 — TODO / COMPAT debt inventory (A-11)
+
+| | |
+|---|---|
+| **Status** | Living inventory — regenerate from source as the tree changes |
+| **Companion to** | [`spec-01-audit-report.md`](spec-01-audit-report.md) finding A-11 |
+| **Snapshot** | branch `claude/adr-docs-setup-ogwz5a`, 2026-06-28 |
+| **Scope** | First-party `loki-*` / `appthere-*` `src/` (production; tests excluded) |
+
+The Spec 01 audit (A-11) flagged the in-code `TODO` / `COMPAT` debt for
+cataloguing so each becomes a tracked decision rather than an invisible note.
+This is that catalogue.
+
+**Headline:** the debt is already disciplined. **All 47 production `TODO`s carry
+a `TODO(<topic>)` tag** (0 bare `TODO`s) — they conform to the CLAUDE.md
+convention and are enforced by `scripts/check-todo-format.py` (CI). The 57
+`COMPAT` annotations are *sanctioned* workaround markers (CLAUDE.md), not debt to
+remove; they are grouped here by target so each can be re-validated when its
+upstream moves — most importantly against the pinned Dioxus `=0.7.9`.
+
+Regenerate the counts below with:
+
+```sh
+git grep -hoE '//\s*TODO\([a-z0-9-]+\)' -- 'loki-*/src/**' 'appthere-*/src/**' | sort | uniq -c | sort -rn
+git grep -hoE '// COMPAT\([a-z0-9-]+\)'  -- 'loki-*/src/**' 'appthere-*/src/**' | sort | uniq -c | sort -rn
+```
+
+---
+
+## 1. COMPAT annotations (57) — grouped by target
+
+`COMPAT` marks a deliberate workaround for an upstream limitation. Each group is
+re-validated when that upstream is upgraded; the largest by far is
+`dioxus-native`, which is why the Dioxus pin (`=0.7.9`, see
+[`docs/patches.md`](../patches.md)) must not be loosened without re-checking
+these.
+
+| Count | Target | Re-validate when… | Notes |
+|------:|--------|-------------------|-------|
+| 32 | `dioxus-native` | the Dioxus `=0.7.9` pin is bumped | Blitz/Dioxus-Native CSS & API gaps; the dominant group. Re-audit on any Dioxus upgrade (patches.md "Upgrading Dioxus"). |
+| 7 | `microsoft` | MS Office reference render changes | Quirks matched to Microsoft 365 (OOXML gold standard). |
+| 6 | `odf` | LibreOffice reference / ODF spec | OpenDocument quirks matched to LibreOffice. |
+| 3 | `android-mali` | Mali GPU driver / wgpu update | Android Mali GPU driver workarounds. |
+| 1 | `android-16` | Android 16 behaviour / android-activity | The `android_main` double-fire guard (now in `loki_app_shell::android_main!`). |
+| 1 | `blitz` | Blitz patch update | Blitz-specific workaround. |
+| 1 | `dioxus` | Dioxus pin bump | Dioxus (non-native) workaround. |
+| 1 | `loro` | Loro CRDT upgrade | Loro behaviour workaround. |
+| 1 | `loro-schema` | Loro schema/version | Loro schema compatibility. |
+| 1 | `loki` | internal | Internal cross-crate compatibility note. |
+
+**Action:** none required now (these are sanctioned). The single tracked
+obligation is process: when the Dioxus pin is bumped, walk the 32
+`COMPAT(dioxus-native)` sites and the `dioxus`/`blitz` ones and confirm each is
+still needed.
+
+---
+
+## 2. TODO items (47) — grouped by topic
+
+All carry a `TODO(<topic>)` tag. Grouped by theme for triage; each is a tracked,
+deferred decision, not a blocker.
+
+### Rendering / layout fidelity (≈18)
+`shadow` ×3 · `partial-render` ×2 · `odt-fidelity` ×2 · `inline-image-flow` ×2 ·
+`font` ×2 · `super-sub` ×2 · `underline-style` ×1 · `strikethrough-style` ×1 ·
+`floating-image` ×1 · `list-picture-bullet` ×1 · `odf-master-page` ×1 ·
+`pdf-rotate` ×1 · `formatting` ×1
+
+### UI / UX / chrome (≈17)
+`ux` ×3 · `link-click` ×3 · `icons` ×3 · `a11y` ×3 · `tabs` ×2 · `theme` ×1 ·
+`ribbon` ×1 · `title-edit` ×1 · `browse-templates` ×1 · `tab-default` ×1
+
+### Editing / model (≈8)
+`3b-3` ×4 · `editing` ×1 · `undo-dirty` ×1 · `loro-bridge` ×1 ·
+`platform` ×2 (platform-specific paths)
+
+**Action:** these are the product backlog expressed in code. The inventory makes
+them discoverable; converting any to a tracked issue is a per-item product
+decision left to the maintainer. The `TODO(<topic>)` format is now mechanically
+enforced so new bare `TODO`s cannot be introduced.
+
+---
+
+## 3. Enforcement (new)
+
+`scripts/check-todo-format.py` (CI) fails on any production `// TODO` /
+`// FIXME` / `// HACK` / `// XXX` that is **not** in the `TODO(<topic>):` form,
+keeping the inventory above meaningful: every deferred note stays greppable by
+topic and can't decay into an anonymous `// TODO`. Baseline is green (all 47
+already conform; 0 `HACK`/`FIXME`/`XXX`).
diff --git a/docs/adr/spec-02-conformance-inventory.md b/docs/adr/spec-02-conformance-inventory.md
new file mode 100644
index 00000000..d789bde6
--- /dev/null
+++ b/docs/adr/spec-02-conformance-inventory.md
@@ -0,0 +1,301 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 02 — Conformance Inventory & Readiness (audit-first)
+
+| | |
+|---|---|
+| **Status** | Draft — inventory complete; B-1 + B-10 resolved; B-11 unblocked; **build progressing: M1 skeleton + M2 schema axis landed; M3 round-trip axis largely done — differ + deepened canonicalizer (tables/metadata) + all 3 shapes (DOCX/ODT/XLSX) wired, 2 export bugs found & fixed (B-7); B-6/B-8 in progress** |
+| **Companion to** | [`spec-02-conformance-testing.md`](spec-02-conformance-testing.md) |
+| **Method** | Read-only audit pass (§3.1). **No code changed.** |
+| **Snapshot** | branch `claude/adr-docs-setup-ogwz5a`, 2026-06-28 |
+| **Depends on** | Spec 01 ([`spec-01-audit-report.md`](spec-01-audit-report.md), [`0009-target-architecture.md`](0009-target-architecture.md)) |
+
+> **Resolution update (2026-06-28).** After this inventory was filed, the maintainer
+> resolved the two findings that needed a decision, and the spec was revised
+> ([`spec-02-conformance-testing.md`](spec-02-conformance-testing.md), D2 / §7.3):
+> - **B-1 — CPU rasterizer:** resolved in favour of an **in-process `vello_cpu`
+>   software rasterizer** (a new conformance-only render path). The llvmpipe-backed
+>   wgpu alternative was rejected. No longer an open blocker.
+> - **B-10 — Gelasio (≈Georgia):** resolved — **Gelasio is to be bundled** under
+>   Spec 02, completing the metric-compatible font set.
+>
+> The original findings are preserved below as the audit-first snapshot; each is
+> annotated inline with its resolution. All other findings (B-2…B-9) remain
+> open for triage — the **Priority** column is still the maintainer's.
+
+> **Spec 01 enforcement update (2026-06-29).** When this inventory was filed,
+> Spec 01's CI pipeline was *"specified but not yet implemented"*, and **B-11**
+> (and §8) flagged that M6 (CI integration) was blocked on it. **That work has
+> since landed:** `.github/workflows/rust.yml`'s lint job now runs **nine
+> structural gates** (license-header, panic-guard, unsafe-policy, file-ceiling,
+> TODO-format, `unwrap_used`/`expect_used`, dependency-direction, viewport-dim) —
+> see [`spec-01-audit-report.md`](spec-01-audit-report.md) §4. So **B-11 is no
+> longer blocked**: the conformance schema + round-trip gates plug into the
+> existing, populated pipeline using the same script-gate-→-lint-job pattern. The
+> few other Spec-01-dependent notes below (B-6's loki-opc SPDX reference, B-3's
+> "1280px-class" analogy) are annotated where they occur.
+
+Spec 02 §1/§3 mandate **audit-first**: "inspect the existing ACID cases, the
+import/export crates, and the render path before building." This document is that
+inventory — it maps the existing corpus to the three axes, assesses what
+machinery already exists vs. must be built, and surfaced the blocking decisions
+(chiefly the CPU-rasterizer gap, now resolved per the banner) so the maintainer
+could triage before any of M1–M6 is implemented. Mirrors the Spec 01 deliverable
+shape; **no crate or gate is built in this pass.**
+
+---
+
+## 1. Executive summary
+
+Loki already has a real fidelity harness — **`loki-acid`** — that operationalises
+a **141-case** `TEST_PLAN.md` corpus and ships much of what Spec 02 calls for
+(machine-readable catalog, SSIM differ, golden discovery, glyph-coverage
+canaries). The shared `appthere-conformance` crate the spec proposes **does not
+exist yet**; the pragmatic path is to *promote and generalise `loki-acid`'s
+modules* into it rather than greenfield.
+
+Axis-by-axis readiness:
+
+| Axis | Existing today | Gap to Spec 02 |
+|---|---|---|
+| **1 — Schema** | nothing; **0 vendored schemas** | Whole axis. *But* `xmllint` **is installed** here, so D6 is feasible immediately. |
+| **2 — Round-trip** | **25 ad-hoc round-trip test files** across `loki-odf`/`loki-ooxml`/etc. | No *normalized-model* differ, no first-divergence path reporting, no unified 3-shape harness. |
+| **3 — Visual goldens** | SSIM differ + golden discovery + a `golden_pixel` test | **0 goldens committed**; no in-process CPU rasterizer (**B-1 resolved → build `vello_cpu`**); threshold is a **guessed `0.98`** (violates D5); SSIM-only (no ΔE, no worst-region). |
+
+**The single blocking finding (B-1) — now resolved.** Loki renders through `vello
+= "0.6"` on **wgpu (GPU)**; there is **no `vello_cpu` dependency** and **no
+software adapter visible** in this environment, so D2's CPU-rasterizer path was
+unbuilt and was the critical-path decision for the visual axis. **Maintainer
+resolution: adopt an in-process `vello_cpu` software rasterizer** (revised spec
+D2). The finding is now an implementation task (M5), not an open question;
+everything else was already reachable.
+
+Good news that de-risks the rest: **`xmllint` and `soffice`/`libreoffice` are
+both present**, and the full metric-compatible font set (Carlito, Caladea, Tinos,
+Cousine, Arimo) is already bundled.
+
+---
+
+## 2. The existing harness — `loki-acid` (map to the shared crate)
+
+`loki-acid` is structured almost exactly along the shared crate's responsibility
+lines (§8). Promotion/reuse map:
+
+| `appthere-conformance` need (§8) | `loki-acid` today | Action |
+|---|---|---|
+| `GoldenHarness` (discovery, diff, artifacts) | `golden.rs` (discovery) + `diff.rs` (SSIM) + `tests/golden_pixel.rs` | **Promote & generalise** — strip Text-specific assumptions; add ΔE + regional scoring + heatmap emit |
+| Perceptual differ | `diff.rs`: `mean_ssim`, `window_ssim`, `abs_diff_ratio` | **Reuse SSIM**; add CIEDE2000/ΔE + worst-region selection |
+| Fixture corpus | `catalog/` (141 `TC-*`), `fixtures.rs` (`include_bytes!`), `assets/` | **Reuse & reorganise** to feature×format×axis (§9) |
+| Severity tags | `severity.rs` (`P0`/`P1`/`P2`) | **Reuse as-is** |
+| Glyph-coverage / page-count canaries | `pages.rs` | **Reuse** (cheap pre-pixel gate, GPU-free) |
+| `SchemaValidator` trait + libxml2 impl | **none** | **Build** (Axis 1) |
+| `RoundTrip` + normalized-model differ | per-crate ad-hoc tests | **Build** the unified differ; fold existing tests in |
+| Pinned PDF→PNG rasterizer wrapper | **none** | **Build** (shared by golden gen + reference) |
+| Calibration tooling | **none**; threshold hardcoded | **Build** (§7.4) |
+
+Constraint from §8: the shared crate "must not contain Text-specific
+assumptions." `loki-acid` today hardcodes the fixture enum and Text/Sheet
+pipelines (`fixtures.rs`), so promotion requires extracting a `Fixture`/`Consumer`
+trait — flagged as the main refactor cost.
+
+---
+
+## 3. Axis 1 — Schema validation (status: unbuilt, but unblocked)
+
+- **Vendored schemas: none.** `git ls-files` finds **0** `.xsd`/`.rng` files.
+  (`loki-doc-model/src/loro_schema.rs` is the Loro CRDT schema — unrelated.) The
+  ISO/IEC 29500 (OOXML Transitional + Strict) XSDs and the OASIS ODF RELAX NG
+  must be vendored and version-pinned (D6).
+- **Validator backend: available now.** `xmllint` is at `/usr/bin/xmllint`, so
+  the `SchemaValidator` libxml2 impl (`--schema` for XSD, `--relaxng` for RNG) is
+  immediately runnable, and the "missing `xmllint` fails loudly" build-time check
+  (§5) is straightforward.
+- **OPC layer:** `loki-opc` produces `[Content_Types].xml` + relationship parts —
+  the crate Axis 1's package-structure validation exercises. (The Spec 01 A-3
+  SPDX-header finding once noted here is now resolved: `loki-opc` is MIT-licensed
+  with correct headers — see [`0010-per-crate-licensing.md`](0010-per-crate-licensing.md).)
+- **Export surfaces to validate** (from the crate graph): DOCX export
+  (`loki-ooxml/src/docx/write/`), ODT/ODS export (`loki-odf/src/odt/write/`,
+  `ods/export.rs`), XLSX export (`loki-ooxml/src/xlsx/export.rs`). Each emits the
+  parts the schema axis must check.
+
+**Verdict:** entirely build-work, but no environmental blocker. Lowest-risk axis
+to land first (matches M2).
+
+---
+
+## 4. Axis 2 — Round-trip (status: rich but un-unified)
+
+There is already **substantial** round-trip testing — **25 files**:
+
+- `loki-odf`: `round_trip.rs`, `round_trip_odf{,2,3,4,5}.rs`, `roundtrip.rs`,
+  `ods_round_trip.rs`, `odt_export_round_trip.rs`, `math_round_trip.rs` (11).
+- `loki-ooxml`: `round_trip.rs`, `round_trip_conformance{,2,3,4,5}.rs`,
+  `comments_round_trip.rs`, `metadata_round_trip.rs`, `style_round_trip.rs`,
+  `math_round_trip.rs`, `pptx_round_trip.rs`, `xlsx_round_trip.rs` (≈14).
+- `loki-doc-model` (`loro_styles_round_trip.rs`), `loki-sheet-model`,
+  `loki-templates`.
+
+What's **missing** vs §6:
+
+- These compare per-crate, often on serialized output or bespoke assertions —
+  there is **no shared *normalized-model* canonical form** with default-value
+  elision / order-insensitivity, and **no first-divergence-with-model-path**
+  reporting. On failure they give a boolean/`assert_eq`, not a diagnosable path.
+- The three **shapes** (§6) aren't cleanly separated. Mapping what exists:
+  - *Native* (`model→serialize→deserialize→model'`): partially covered by
+    `loro_styles_round_trip` / export round-trips.
+  - *Import-export-import*: closest to `round_trip_conformance*` in `loki-ooxml`.
+  - *Reference-anchored*: the `acid_*.{docx,odt}` fixtures (authored by
+    Office/LO) exist in `loki-acid/assets/`, but no test does import→export→
+    re-import stability on them.
+- The "bookmark-id class" the spec calls out (§6 / M3) needs a dedicated
+  normalized-equality case; not currently isolated.
+
+**Verdict:** the *coverage* exists; the *infrastructure* (one normalized differ,
+generic over a consumer model-equality impl, with path-precise diffs) does not.
+Fold the 25 existing tests into it rather than discard.
+
+---
+
+## 5. Axis 3 — Visual goldens (status: scaffold only; one hard blocker)
+
+### 5.1 What exists
+
+- `diff.rs`: windowed SSIM (`mean_ssim` tiles into `WINDOW`-sized blocks but
+  **averages** them), plus `abs_diff_ratio`. Pure-Rust, GPU-free. ✅
+- `golden.rs`: `goldens/<stem>/page-NNN.png` ↔ `renders/<stem>/page-NNN.png`
+  discovery. ✅
+- `tests/golden_pixel.rs`: SSIM-asserts matched pairs.
+
+### 5.2 Gaps (each a triage item)
+
+- **B-1 — No CPU rasterizer (was blocking, D2). ✅ RESOLVED → `vello_cpu`.**
+  Render path is `vello = "0.6"` on `wgpu = "26"`. `loki-renderer/src/vello_init.rs`
+  sets `use_cpu: true`, but that is wgpu's CPU *compute* fallback — it still
+  requires a wgpu adapter (the `render_to_png` example aborts with "a software
+  rasterizer e.g. llvmpipe is required"), and no software adapter is visible in
+  this environment. There is **no `vello_cpu` crate** in the tree. The golden
+  harness consumes pre-rendered PNGs from `renders/` — i.e. rendering is
+  **external today**, exactly the non-reproducibility D2 wants to eliminate.
+  **Maintainer decision:** adopt **`vello_cpu`** (the Vello project's CPU
+  rasterizer) as a conformance-only render backend; llvmpipe-backed wgpu rejected
+  (revised spec D2 / §12). Now an M5 implementation task — add the `vello_cpu`
+  candidate entry point alongside the GPU path.
+- **B-2 — Zero goldens committed.** `loki-acid/goldens/` holds only `README.md`;
+  `renders/` is empty; `find … -name '*.png'` = 0. The visual axis has **no
+  reference data**. M4 (generation) must run before M5 means anything. `soffice`
+  is present → ODF bulk generation (LO headless → PDF → PNG) is runnable here;
+  OOXML goldens still need the manual Windows/Office COM procedure (§7.2).
+- **B-3 — Threshold is a guessed magic number (violates D5).**
+  `golden_pixel.rs:18` hardcodes `const SSIM_THRESHOLD: f64 = 0.98;` with no
+  calibration record. D5/§7.4 require this be *derived* from a measured
+  cross-renderer noise floor and committed. (This is precisely the "1280px-class"
+  magic-number pattern Spec 01 just **eliminated** in the editor — A-1 — applied
+  here in the test domain: a load-bearing literal nobody measured.)
+- **B-4 — Differ is SSIM-only and averaged.** §7.4 wants **SSIM + CIEDE2000/ΔE**,
+  **regional/tiled scoring where the worst region drives the result** (not the
+  mean), per-test tolerance overrides, and **failure heatmaps**. Today: mean SSIM,
+  no ΔE, no worst-region, no heatmap, no per-test override.
+- **B-5 — No shared PDF→PNG rasterizer (D3).** Both reference apps must rasterize
+  via one pinned PDF→PNG stage; that wrapper doesn't exist. `loki-pdf` exists for
+  *export*, and `loki-acid/examples/render_acid_pdf.rs` exists, but no pinned
+  PDF→raster stage is shared between golden and candidate.
+
+### 5.3 Fonts (D4) — essentially satisfied
+
+All metric-compatible faces are **already bundled** in `loki-fonts/fonts/`:
+Carlito (≈Calibri), Caladea (≈Cambria), Tinos (≈Times New Roman), Cousine
+(≈Courier New), Arimo (≈Arial), each in Regular/Bold/Italic/BoldItalic, plus
+AtkinsonHyperlegibleNext. `loki-fonts/src/lib.rs` maps the proprietary names
+(Calibri/Cambria) to substitutes. So:
+
+- **Fidelity fixtures** (reference the bundled names directly) — ready.
+- **Substitution suite** (reference Calibri/Times New Roman, assert mapping +
+  warning) — the engine exists (`lib.rs` mappings); the dedicated suite does not.
+- **Caveat (B-10) — ✅ RESOLVED.** The spec's "third bundled C-font equivalent"
+  (Gelasio ≈ Georgia) was **not present** — only Carlito + Caladea of that family.
+  **Maintainer decision: bundle Gelasio** under Spec 02 (revised spec §7.3), so the
+  corpus can exercise a Georgia-family fixture. Now an asset-add task.
+- **Reference machines must install these fonts** for golden generation to be
+  meaningful (operator note for §7.2).
+
+---
+
+## 6. Environment capability check (what this box can/can't do)
+
+| Capability | Needed by | Status here |
+|---|---|---|
+| `xmllint` (libxml2) | Axis 1, M2 | ✅ `/usr/bin/xmllint` |
+| `soffice` / `libreoffice` headless | M4 ODF goldens | ✅ `/usr/bin/soffice` |
+| MS Office / Word COM | M4 OOXML goldens | ❌ Windows-only (Kevin's box; manual) |
+| wgpu software adapter (llvmpipe) | GPU render / CPU-compute fallback | ❌ none visible — rejected alternative (see B-1) |
+| `vello_cpu` rasterizer | D2 candidate render | ❌ not yet a dependency — **to be added (B-1 resolved)** |
+| Metric-compatible fonts | D4 | ✅ bundled in `loki-fonts` (Gelasio to be added, B-10) |
+
+The agent/CI environment is **GPU-free**, exactly the condition §4/§7.1 target —
+which is *why* the resolved B-1 choice (an in-process `vello_cpu` rasterizer,
+needing no graphics adapter) is what lets the visual axis run here at all.
+
+---
+
+## 7. Triage table — Priority left blank for maintainer (mirrors Spec 01 D1)
+
+| ID | Axis/Area | Finding | Blast radius | Proposed action | Priority |
+|----|-----------|---------|--------------|-----------------|----------|
+| B-1 | Visual / D2 | No CPU rasterizer; render is GPU-only, external PNGs | **Foundational** | ✅ **Resolved → `vello_cpu`** (llvmpipe-wgpu rejected); build conformance-only `vello_cpu` render entry point (M5) | **Resolved** |
+| B-2 | Visual / M4 | 0 goldens committed | **Large** | Stand up generation; LO-headless ODF set first (runnable here), OOXML manual | |
+| B-3 | Visual / D5 | Threshold hardcoded `0.98`, uncalibrated | **Small (now), gating (later)** | Calibration pass + committed record; replace constant | |
+| B-4 | Visual / §7.4 | SSIM-only, averaged; no ΔE/worst-region/heatmap/override | **Medium** | Extend `diff.rs`: CIEDE2000, regional worst-region, heatmap, per-test override | |
+| B-5 | Visual / D3 | No shared pinned PDF→PNG stage | **Medium** | Build rasterizer wrapper; share golden+candidate | |
+| B-6 | Schema / M2 | 0 vendored schemas | **Medium** | 🔨 **Validator done** — `schema::SchemaValidator` + libxml2 `XmllintValidator` (XSD + RNG, located violations, fails-loud), tested; CI installs `libxml2-utils`. **Remaining:** vendor + pin ISO 29500 / ODF RNG and validate real exports (`schemas/README.md`). | |
+| B-7 | Round-trip / M3 | 25 ad-hoc tests, no normalized differ / path reporting | **Medium** | 🔨 **Differ + model adapter + first shape wired** — `roundtrip::{NormalizedModel, first_divergence}` plus `model::canonicalize_document` (feature `doc-model`): `NormalizedModel for loki_doc_model::Document` walking paragraphs/runs/marks/bookmarks/styles. Tested on real `Document`s incl. dropped run property, changed property, **mangled bookmark id**, dropped text, structural change. **Import→export→import shape now live** in `loki-ooxml` (dev-dep `appthere-conformance/doc-model`): `conformance_round_trip.rs` green-guards core word-processing content (para/heading/bold-run/bookmark) through real DOCX write+read, and an `#[ignore]`'d reference-fixture test exercises the comprehensive fixture. **First real bug found *and fixed* via the harness:** the reference round-trip surfaced a content-loss gap at `blk0005/i0000/i0000` — DOCX export's `emit_char_props` silently omitted several run properties the importer reads (highlight, letter-spacing, all-caps, scale, shadow, kerning, complex/East-Asian fonts+size, run background, language), so a run formatted *only* by one of them exported with an empty `<w:rPr>`, collapsed to a plain run, and merged with neighbours (dropping the `StyledRun` and adjacent text). Fixed by making `emit_char_props` symmetric with the reader (new `docx/write/run_props.rs` + `run_props_tests.rs`); regression-locked by `docx_round_trip_preserves_secondary_run_formatting`. A **second** harness-found bug followed at `blk0026/i0001`: footnote-reference export hard-coded an explicit `<w:vertAlign superscript>` the source model never had — fixed by dropping the redundant run property and always emitting the `FootnoteReference`/`EndnoteReference` character styles (which carry the superscript, as Word does). **The full comprehensive reference fixture now round-trips with zero model divergence**, so `docx_reference_round_trip_is_stable` is promoted from `#[ignore]` gap-finder to a permanent green guard. **Canonicalization deepened** beyond paragraph/run depth: table interiors (`model/tables.rs` — rows/cells/spans/cell-blocks) and document metadata (`model/meta.rs` — core + custom + extended Dublin Core) are now walked, with model tests for each. **All three round-trip *shapes* are wired:** DOCX (`loki-ooxml`), **ODF/ODT** (`loki-odf/tests/conformance_round_trip.rs` — core + table + secondary formatting + bookmarks, all clean), and **sheet/XLSX** (new `sheet-model` feature + `NormalizedModel for Workbook` in `sheet/mod.rs`; `loki-ooxml/tests/conformance_xlsx_round_trip.rs` — values/formula/style/column-width, clean). The genuine DOCX export→re-import tests (metadata, math, comments) are **folded through the differ** (whole-model first-divergence backstop on top of their bespoke asserts). *Finding:* the `round_trip*.rs` / `round_trip_conformance*.rs` files (the "25") are **import-only smoke tests**, not export→re-import round-trips, so the differ does not apply to them. **Remaining (smaller):** ODS/sheet export gaps as they surface; promote `loki-acid`'s catalog into a shared fixture corpus (overlaps B-8/B-9). | **Largely done** |
+| B-8 | Shared crate / M1 | `appthere-conformance` absent; `loki-acid` is Text-coupled | **Large** | 🔨 **Skeleton up** — `appthere-conformance` crate created (workspace member, `forbid(unsafe_code)`, 3 axis modules), wired into the dep-direction gate (exempt). **Remaining:** promote `loki-acid`'s catalog/SSIM/golden-discovery; extract `Fixture`/`Consumer` traits. | |
+| B-9 | Corpus / §9 | 141 TC cases flat; not organised feature×format×axis; ODP/ODG/PPTX importers absent | **Medium** | Reorganise on disk; record axes+ref-app+overrides per fixture (PPTX gap = Presentation scope) | |
+| B-10 | Fonts / D4 | Gelasio (≈Georgia) not bundled; substitution suite absent | **Small** | ✅ **Resolved → bundle Gelasio**; still author the substitution suite | **Resolved** |
+| B-11 | CI / §11 M6 | ✅ **Unblocked** — Spec 01 pipeline now built (9 gates in `rust.yml`) | **Sequencing** | Land schema+round-trip as hard gates (and visual post-calibration) into the now-populated lint job, same script-gate pattern | **Unblocked** |
+
+---
+
+## 8. Sequencing & dependency on Spec 01
+
+Spec 02 §0 depends on Spec 01's CI pipeline and enforcement primitives. When this
+inventory was filed those were "specified but not yet implemented"; **as of
+2026-06-29 they are built** — [`spec-01-audit-report.md`](spec-01-audit-report.md)
+§4 lists nine structural gates live in `rust.yml`. So **M6 (CI integration) is no
+longer blocked**: the schema and round-trip gates plug into the populated lint job
+exactly like the gates already there (a script under `scripts/`, one `run:` step).
+The axes themselves (M1–M5) build against the existing `loki-acid` regardless.
+Recommended order, lowest-risk-first and independent of B-1:
+
+1. **B-8 + B-6** — crate skeleton + schema axis (no GPU, `xmllint` ready). = M1+M2.
+2. **B-7** — normalized round-trip differ + deepened canonicalizer, all 3 shapes
+   (DOCX/ODT/XLSX) wired, genuine round-trip tests folded in. = M3. ✅ *largely done.*
+3. **B-1 (resolved → `vello_cpu`) + B-2/B-5** — CPU rasterizer + ODF golden generation. = M4.
+4. **B-4 + B-3** — extended differ + calibration record. = M5.
+5. **B-11** — wire the schema + round-trip gates into the lint job (Spec 01's
+   pipeline is now built, so this is ready whenever M2/M3 land). = M6.
+
+---
+
+## 9. Acceptance check against the audit-first method (§3.1)
+
+- ✅ Existing ACID corpus inventoried (141 `TC-*`; 22 P0 / 82 P1 / 47 P2; 7 asset
+  fixtures, importer coverage per `loki-acid/README.md`).
+- ✅ Each case-family mapped to axes (catalog↔corpus §9; round-trip tests §4;
+  visual scaffold §5).
+- ✅ Import/export crates inspected (`loki-ooxml`, `loki-odf`, `loki-opc`).
+- ✅ Render path inspected — **CPU-rasterizer gap surfaced as B-1** (the spec's
+  determinism premise vs. the actual GPU-only path).
+- ✅ Environment capabilities verified (`xmllint`/`soffice` present; no GPU).
+- ✅ Triage table populated **except** Priority (maintainer, per Spec 01 D1).
+- ✅ **No code changed.**
+
+**Honest scope note:** this is the read-only inventory only. Building
+`appthere-conformance`, vendoring schemas, the CPU render backend, golden
+generation, and calibration (M1–M6) are deferred pending maintainer triage of the
+table above (B-1, B-10 resolved; B-11 unblocked; B-2…B-9 still open). The earlier
+caveat that M6 was gated on un-built Spec 01 infrastructure **no longer applies**
+— that pipeline now exists (9 gates).
diff --git a/docs/adr/spec-02-conformance-testing.md b/docs/adr/spec-02-conformance-testing.md
new file mode 100644
index 00000000..a8cb508f
--- /dev/null
+++ b/docs/adr/spec-02-conformance-testing.md
@@ -0,0 +1,202 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 02 — Conformance Testing Harness
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation. The "✅ Resolved" B-items below are audit **decisions**, not shipped code. |
+| **Scope** | AppThere Loki (Text), DOCX + ODT; harness designed as shared monorepo infrastructure |
+| **Sequence** | 2 of 6 — establishes model trustworthiness before styling is built on top |
+| **Depends on** | Spec 01 (CI pipeline, the `Viewport`/`LayoutContext` type, enforcement primitives at monorepo root) |
+| **Feeds** | Styling Panel (trusted model), and the schema/round-trip CI gates Spec 01 reserved a slot for |
+
+> **Not-yet-built (verified 2026-07-04, [`deferred-features-audit`](../deferred-features-audit-2026-07-04.md)):** the harness is still unimplemented — the `vello_cpu` candidate render path (no `vello` dep in `appthere-conformance`), the vendored ISO 29500 / ODF schemas (`schemas/` is a README only), zero committed goldens, the uncalibrated SSIM threshold, and the **Gelasio** font bundling (below) are all *decisions awaiting implementation*, not done work.
+
+---
+
+## 1. Context & Motivation
+
+Loki claims rendering and round-trip fidelity against two reference implementations: **Microsoft Office** (the OOXML gold standard) and **LibreOffice** (the ODF gold standard). Today that claim is asserted by an ad-hoc ACID test plan (~130 cases, P0–P2) but not mechanically verified end to end. This spec builds the harness that verifies it, on three independent axes:
+
+1. **Schema validation** — exported files are well-formed against the official OOXML (XSD / ISO-IEC 29500) and ODF (RELAX NG / OASIS) schemas. Catches malformed output regardless of how it renders.
+2. **Round-trip stability** — importing, exporting, and re-importing a document does not silently lose or mutate semantic content. Compared on the *model*, not the bytes.
+3. **Visual goldens** — Loki's render of a fixture matches a committed golden PNG produced by the reference application, within a calibrated perceptual tolerance.
+
+These axes are independent on purpose: a file can be schema-valid but render wrong, or render right but lose data on re-save. Each axis fails for its own reason and points at its own bug class.
+
+The harness is not greenfield. A working ACID harness already exists as **`loki-acid`** — it operationalizes a 141-case `TEST_PLAN.md` corpus (22 P0 / 82 P1 / 47 P2) with an SSIM differ, golden discovery, and glyph-coverage canaries. This spec's infrastructure is therefore framed as a **promotion of `loki-acid`'s reusable modules into a shared `appthere-conformance` crate** at the repo root (alongside the dylint/CI primitives from Spec 01), *not* a from-scratch build. Loki Text is its first consumer; the Presentation and Spreadsheet apps consume the same machinery through their own fixture corpora and model-equality implementations. This spec implements the Text suite and the shared crate; the other two apps' suites are out of scope here but must not require changes to the shared crate to exist.
+
+This is **audit-first**: the inventory pass (already run) confirmed `loki-acid` as the foundation, `xmllint`/`soffice` as available, the metric-compatible fonts as bundled, and the gaps to close (no vendored schemas, no shared normalized-model differ, zero committed goldens, a hardcoded threshold, no in-process CPU rasterizer). References below are illustrative; inspect the live code before changing it.
+
+---
+
+## 2. Goals / Non-Goals
+
+**Goals**
+
+- A shared `appthere-conformance` crate, promoted from `loki-acid`, providing the golden harness, perceptual differ, schema validators, and round-trip helpers.
+- Deterministic, reproducible visual comparison that runs **without a GPU** and in CI, via an in-process `vello_cpu` software rasterizer.
+- Committed binary golden PNGs for reproducibility.
+- A documented, repeatable golden-generation procedure for both reference apps.
+- A calibrated, documented perceptual threshold that retires the hardcoded `SSIM_THRESHOLD = 0.98`.
+- Schema-validation and round-trip CI gates plugged into the Spec 01 pipeline.
+
+**Non-Goals**
+
+- Presentation/Spreadsheet suites (separate consumers; this spec only must not block them).
+- Testing the GPU render path's pixel output as the *fidelity* reference (see D2 — fidelity uses the CPU rasterizer; GPU/CPU parity is a separate, smaller, local concern).
+- Authoring new fixtures beyond formalizing and filling gaps in the existing ~130-case corpus.
+- Perfect cross-renderer pixel identity (impossible; the whole point of perceptual tolerance).
+
+---
+
+## 3. Working Method
+
+1. **Promote, don't greenfield.** Lift `loki-acid`'s reusable modules (catalog, SSIM differ, golden discovery, glyph canaries) into `appthere-conformance` behind clean traits; map each of the 141 existing cases to one or more of the three axes (import-only, export-only, full round-trip).
+2. **Fill the axis gaps** the inventory found: vendored schemas (Axis 1), a shared normalized-model differ (Axis 2), the `vello_cpu` candidate path + ΔE/worst-region scoring (Axis 3).
+3. **Stand up generation** procedures and produce the first golden set.
+4. **Calibrate** the perceptual threshold (§7.4), retiring the hardcoded `0.98`, and commit the calibration record.
+5. **Wire CI**: schema + round-trip as hard gates; visual goldens as a gate once calibrated.
+
+---
+
+## 4. The Three Axes — boundaries
+
+| Axis | Input | Compares | Runs in CI? | GPU? |
+|------|-------|----------|-------------|------|
+| Schema validation | Loki's exported file | XML against official schema | Yes (hard gate) | No |
+| Round-trip stability | Fixture → Loki model | Normalized model equality | Yes (hard gate) | No |
+| Visual goldens | Fixture → Loki `vello_cpu` render | Perceptual diff vs committed golden | Yes (once calibrated) | No (`vello_cpu` software rasterizer) |
+
+All three are headless and GPU-free, which is what lets them run in CI and inside the GPU-less agent environment.
+
+---
+
+## 5. Axis 1 — Schema Validation
+
+For every export the harness produces, validate the serialized XML against the official schema before any rendering question is asked.
+
+- **OOXML**: validate each significant part (`document.xml`, `styles.xml`, `numbering.xml`, …) against the ISO/IEC 29500 schemas. Validate **Transitional** by default, with Strict as an opt-in stricter pass. Additionally validate the OPC layer: `[Content_Types].xml`, relationship parts, and package structure (this is where `loki-opc` correctness is exercised).
+- **ODF**: validate against the OASIS ODF RELAX NG schema, plus the ODF manifest.
+
+**Implementation note:** a pure-Rust XSD/RNG validator is scarce. The pragmatic path is shelling to `libxml2` (`xmllint --schema` for XSD, `xmllint --relaxng` for RNG), with the schema files vendored and version-pinned in the repo so validation is reproducible and offline. The shared crate wraps this behind a `SchemaValidator` trait so a future pure-Rust backend can replace it without touching consumers. Validator availability is a build-time check, not a silent skip — a missing `xmllint` fails loudly.
+
+**Pass criterion:** zero schema violations. This is a hard CI gate (the slot Spec 01 reserved).
+
+---
+
+## 6. Axis 2 — Round-Trip Stability
+
+Three round-trip shapes, all compared on a **normalized model**, never on bytes (byte equality is neither achievable nor meaningful):
+
+1. **Native**: `model → serialize → deserialize → model'`. Asserts the serializer/deserializer pair is lossless for Loki's own model.
+2. **Import-export-import**: `fixture → import → export → import → model'`, comparing the two imported models. Asserts export doesn't drop what import understood.
+3. **Reference-anchored**: import a reference-app-authored file, export it, re-import, assert stability. Catches asymmetries between what Loki reads and what it writes.
+
+**Normalized equality.** Define a canonical form that ignores semantically-insignificant differences (element ordering where the format permits, whitespace normalization, default-value elision) but catches real loss (a dropped run property, a collapsed style, a mangled bookmark id — cf. the Fix Session 01 bookmark bug). On mismatch, the differ reports the **first divergence with a model path**, not just a boolean, so failures are diagnosable.
+
+**Pass criterion:** normalized model equality across all three shapes. Hard CI gate.
+
+---
+
+## 7. Axis 3 — Visual Goldens
+
+The involved axis. A fixture document is rendered by the reference app (the golden) and by Loki (the candidate), and the two PNGs are compared perceptually.
+
+### 7.1 Determinism is the whole problem
+
+Loki's production render path is Vello **0.6 on wgpu (GPU)**. GPU rasterization is not bit-reproducible across drivers and hardware, and the agent/CI environment has no GPU at all. (The audit confirmed `use_cpu: true` is only wgpu's *compute* fallback — it still requires a software adapter like llvmpipe, so it does not solve this.) Committing golden PNGs and comparing against a GPU render would be non-reproducible by construction.
+
+**Decision (D2): conformance rendering uses `vello_cpu`, an in-process software rasterizer, at a fixed DPI and pinned anti-aliasing settings.** This makes the candidate side deterministic, reproducible, and runnable headless in CI and in the agent environment with no system graphics adapter at all. It is a genuinely *new* render path — Loki does not have one today — and the implementing agent must add a `vello_cpu` candidate entry point alongside the existing GPU path.
+
+Carrying a second render path is the cost of this decision. Two things contain that cost: (1) the candidate path renders the same Vello scene graph the GPU path builds, so divergence is confined to the rasterizer, not the scene; and (2) the **CPU/GPU parity** check (the same scene rendered both ways, expected to agree within tolerance) exists precisely to keep the two honest. That parity check is local-only because it needs a GPU; fidelity-vs-reference always uses `vello_cpu`. Note that fidelity is judged against the *reference application's* golden, never against Loki's own GPU output, so `vello_cpu` not being pixel-identical to GPU Vello is expected and harmless.
+
+### 7.2 Golden generation
+
+Goldens are committed binary PNG blobs. Generation is offline (never in CI) and documented as a repeatable procedure:
+
+- **OOXML goldens — Microsoft Office on Windows (manual).** Run on Kevin's Windows box. Provide a helper script (Word COM automation → export to PDF → rasterize each page with a pinned PDF rasterizer at the conformance DPI) so the human step is "run the script over the fixture set," and the rasterization stage is identical to every other path. The procedure is checked in; the operator and Office version are recorded next to the goldens.
+- **ODF goldens — LibreOffice headless (scripted).** `soffice --headless` converting each fixture to PDF, then the same pinned PDF→PNG rasterizer at the conformance DPI. Scriptable end to end, which is why LO headless is the fast path for bulk initial generation.
+
+Both reference apps rasterize *via PDF* through one shared rasterizer so the golden and candidate sides differ only in the layout/render engine, not in the PNG encoder or DPI.
+
+### 7.3 Font parity
+
+Comparison is meaningless unless both sides use the same fonts. Loki bundles the metric-compatible set: **Carlito** (≈ Calibri), **Caladea** (≈ Cambria), and the third bundled C-font equivalent; plus the newly-added **Tinos** (≈ Times New Roman), **Cousine** (≈ Courier New), **Arimo** (≈ Arial) for the classic web-safe faces. **Gelasio** (≈ Georgia) is *to be* added as a bundled asset under this spec — the audit found it the one missing metric-compatible face — so the corpus can exercise a Georgia-family fixture. (Not yet bundled: `loki-fonts/fonts/` has no Gelasio face as of 2026-07-04.) The reference machines (Windows/Office, LibreOffice) must have the same set installed.
+
+- **Fidelity fixtures reference the metric-compatible font names directly** (Carlito, Tinos, …). This isolates *rendering* from *substitution*: both reference app and Loki use the literal bundled font, so any diff is a rendering difference, not a substitution disagreement. The reference machines must have these fonts installed.
+- **A separate, smaller substitution suite** authors fixtures referencing the *original* proprietary names (Calibri, Times New Roman) and asserts Loki's substitution engine maps them to the bundled equivalents and warns appropriately (this ties into the font-substitution warning redesigned in Spec 03). Kept apart so the substitution variable never contaminates fidelity scoring.
+
+### 7.4 Perceptual diff & calibration
+
+- **Metric:** structural similarity (SSIM) for layout/shape agreement, combined with a perceptual color delta (CIEDE2000 / ΔE in a perceptual space) for color/AA differences. Both are computed; a test fails if either crosses its threshold.
+- **Regional scoring:** the page is tiled and scored per region, so a small localized failure (one mis-rendered glyph) isn't averaged away by a large correct page. The worst region drives the result.
+- **Calibration, not a guessed number:** the harness today carries a hardcoded `SSIM_THRESHOLD = 0.98` — the same magic-number-as-folklore anti-pattern Spec 01's 1280px bug represents, and exactly what this decision retires. Run a calibration pass over a baseline set of fixtures believed correct, measure the *natural* cross-renderer noise floor (AA, hinting, subpixel positioning differ even when both are "right"), and set the default threshold a documented margin above that floor. The calibration record — corpus, measured distributions, chosen thresholds, date, font/tool versions — is committed alongside the goldens. The threshold is data, not folklore. (The Spec 01 `no_hardcoded_layout_dims` lint won't catch this literal — different code path — so the calibration requirement is the enforcement here.)
+- **Per-test tolerance override** for legitimately hard cases (complex gradients, certain table borders), each override carrying a comment justifying it.
+- **Failure artifacts:** on failure the harness emits a heatmap diff PNG and the per-region scores, so a regression is inspectable without re-running locally.
+
+**Pass criterion:** every region under threshold (or under its justified per-test override). Becomes a CI gate once §7.4 calibration lands; advisory until then.
+
+---
+
+## 8. The Shared Crate — `appthere-conformance`
+
+Created by **promoting `loki-acid`'s reusable modules** (catalog, SSIM differ, golden discovery, glyph canaries), not by greenfield authoring. Lives at the monorepo root with the Spec 01 enforcement primitives. Provides:
+
+- `SchemaValidator` trait + libxml2-backed impl, with vendored pinned schemas. *(New — `loki-acid` has none.)*
+- `RoundTrip` helpers + a normalized-model differ generic over a consumer-supplied model-equality impl. *(New shared layer over the 25 existing ad-hoc per-crate round-trip tests.)*
+- `GoldenHarness`: fixture discovery (lifted from `loki-acid`), `vello_cpu` candidate render *(new)*, golden load, perceptual diff extended with ΔE + worst-region scoring + heatmaps *(SSIM lifted, the rest new)*, artifact emission.
+- The pinned PDF→PNG rasterizer wrapper shared by generation and (where relevant) candidate paths.
+- Calibration tooling. *(New — replaces the hardcoded threshold.)*
+
+Consumers (Text, later Presentation/Spreadsheet) supply: a fixture corpus, a model type + normalized-equality impl, an importer/exporter pair, and a `vello_cpu` render entry point. They get all three axes for free. The crate must not contain Text-specific assumptions.
+
+---
+
+## 9. Fixture Corpus
+
+Formalize the existing **141-case** corpus (the `loki-acid` `TEST_PLAN.md`: 22 P0 / 82 P1 / 47 P2) into a discoverable on-disk layout, organized by **feature × format × axis**, retaining the P0–P2 severity tags. Each fixture records: the feature it exercises, which axes apply, the reference app and version used for its golden, and any per-test tolerance override with justification. The known gap (PPTX generation incomplete due to a timeout) is Presentation-suite scope, not Text; note it as a cross-reference, don't solve it here.
+
+---
+
+## 10. Key Decisions (ADR-style)
+
+**D1 — Three independent axes.** Schema, round-trip, and visual fail for different reasons and catch different bugs; coupling them would mask faults. Tradeoff: more infrastructure than a single "does it look right" check, justified by diagnosability.
+
+**D2 — Conformance renders on `vello_cpu` (in-process software rasterizer), not GPU.** Determinism and CI/agent-without-GPU demand it; committed goldens require a reproducible candidate, and wgpu's `use_cpu` compute fallback still needs a software adapter so it doesn't qualify. GPU correctness is covered by a separate local CPU/GPU parity check. Tradeoff: a genuinely new second render path to maintain — accepted because it shares the scene graph with the GPU path and the parity check keeps them aligned, and because the alternative (pinned-llvmpipe wgpu or a local-only visual gate) either adds a brittle pinned system dependency or removes CI visual coverage entirely.
+
+**D3 — Both reference apps rasterize via one shared PDF→PNG stage.** Golden and candidate then differ only in layout/render engine, not encoder/DPI. Tradeoff: a PDF round-trip on the golden side; acceptable since it's identical across all goldens.
+
+**D4 — Fidelity fixtures use metric-compatible font names directly; substitution gets its own suite.** Isolates rendering from substitution so a diff has one meaning. Tradeoff: real-world docs reference proprietary names — covered by the dedicated substitution suite instead.
+
+**D5 — Threshold is calibrated and committed, not guessed.** A documented noise-floor measurement sets it; the record lives in the repo. Tradeoff: a calibration step before the visual gate can turn hard — worth it to avoid a meaningless magic number.
+
+**D6 — Schemas and tools are vendored and version-pinned.** Reproducible, offline validation. Tradeoff: periodic manual schema updates; acceptable for determinism.
+
+---
+
+## 11. Milestones & Acceptance Criteria
+
+**M1 — Promote `loki-acid` to the shared crate skeleton.** `appthere-conformance` with the three axis traits and the rasterizer wrapper, lifting `loki-acid`'s catalog/SSIM/discovery; Text wired as the first consumer; the 141 cases mapped to axes. *Accept:* a trivial fixture flows through all three axes (even if visual is advisory); no regression in existing `loki-acid` coverage.
+
+**M2 — Schema axis live.** Vendored pinned OOXML/ODF schemas; OPC + manifest validation; libxml2-backed validator (`xmllint` confirmed available). *Accept:* a deliberately malformed export fails the gate; valid exports pass; missing `xmllint` fails loudly.
+
+**M3 — Round-trip axis live.** Shared normalized differ unifying the 25 existing ad-hoc round-trip tests + all three round-trip shapes; first-divergence reporting. *Accept:* a seeded loss (e.g. a dropped run property) is caught with a model path; the bookmark-id class is covered.
+
+**M4 — Golden generation.** Documented OOXML (manual/COM) and ODF (LO headless — `soffice` confirmed available) procedures; shared PDF→PNG rasterizer; first golden set committed with operator/version metadata. *Accept:* regenerating an ODF golden from scratch reproduces the committed bytes; the OOXML procedure is runnable by following the checked-in doc.
+
+**M5 — `vello_cpu` candidate path + visual axis + calibration.** New `vello_cpu` render entry point; SSIM + ΔE regional differ replacing the hardcoded `0.98`; committed calibration record; failure heatmaps. *Accept:* the `vello_cpu` path renders headless with no graphics adapter; a deliberately mis-rendered fixture fails with a heatmap; a correct one passes; the threshold traces to the calibration data, not a literal.
+
+**M6 — CI integration.** Schema + round-trip as hard gates; visual as a gate post-calibration. *Accept:* the full suite runs headless in CI with no GPU; the three gates can fail a PR independently.
+
+---
+
+## 12. Out of Scope
+
+- Presentation and Spreadsheet suites (separate consumers; the shared crate must merely not block them). The incomplete PPTX generation is theirs.
+- GPU render-path pixel testing as the fidelity reference (→ local CPU/GPU parity check only). Pinned-llvmpipe wgpu and a local-only visual gate were considered and rejected in favor of `vello_cpu` (see D2).
+- Authoring net-new fixtures beyond filling corpus gaps.
+- The font-substitution *warning UI* (→ Spec 03); this spec only exercises the substitution *engine* in its dedicated suite.
+- A pure-Rust schema validator (the trait permits one later; the first impl shells to libxml2).
diff --git a/docs/adr/spec-03-responsive-audit.md b/docs/adr/spec-03-responsive-audit.md
new file mode 100644
index 00000000..b10862a9
--- /dev/null
+++ b/docs/adr/spec-03-responsive-audit.md
@@ -0,0 +1,263 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 03 — Responsive UI Foundation: Audit Report
+
+| | |
+|---|---|
+| **Status** | Audit complete; triaged → **M1–M5 implemented** (Breakpoint foundation, page-fit switch, font-warning redesign, bounded reflow typography, cross-UI sweep). Spec 03 done; ribbon responsive collapse (R-13e/R-14) handed to Spec 04 as specified. |
+| **Method** | Audit-first per Spec 03 §4. Confirms the Blitz responsive surface, locates the font-warning component and the paginated↔non-paginated switch, and inventories every chrome surface that misbehaves when narrow. |
+| **Companion** | [spec-03-responsive-ui-foundation.md](spec-03-responsive-ui-foundation.md) (the design spec) |
+| **Precedent** | Same audit-then-triage flow as [spec-01-audit-report.md](spec-01-audit-report.md) and [spec-02-conformance-inventory.md](spec-02-conformance-inventory.md). |
+
+This report establishes ground truth and a finding register (R-1 … R-15). It
+makes **no code changes** — like Spec 01/02, implementation waits for the
+maintainer to triage the findings and confirm the breakpoint tiers and crate
+placement.
+
+---
+
+## 1. Executive summary
+
+- **The Blitz responsive-surface question (Working Method §4.1) is answered: CSS
+  `@media` width queries are *not used anywhere* in production, so D1 holds —
+  the programmatic `Breakpoint` signal must be the single source of truth.** The
+  three standing Blitz constraints (`position: fixed`, `box-shadow`, CSS custom
+  properties) are real and *already observed*: **zero** instances of any of them
+  in `loki-text` / `appthere-ui` / `loki-renderer`.
+- **The Spec 01 dependency is *partially* landed.** The width source is unified
+  (`Viewport`, one measured value) — the load-bearing fact Spec 03 relies on is
+  true. But `Viewport` carries **only** `inner_width_px` (no zoom / DPI / page
+  geometry), and it lives in the **app layer** (`loki-text/src/editing/`), not in
+  shared UI infrastructure. Both must change for Spec 03 (R-2, R-3).
+- **There is no breakpoint system, and width thresholds are already
+  fragmented.** Three different magic numbers decide responsive behaviour today:
+  `BREAKPOINT_DESKTOP_PX = 768` (home tab), `REFLOW_BREAKPOINT_PX = 900`
+  (renderer switch), and Spec 03 proposes 600/1024. Unifying these is exactly
+  M1's job (R-4).
+- **The named offender is confirmed.** The font-substitution warning is a
+  full-width flex-row band that never stacks, has no severity model, and no
+  status-bar recovery (R-9 … R-12).
+- **The renderer switch is a bare width guess** (`width < 900`), with **no
+  page-fit, no zoom/DPI, and no hysteresis** on the mode boundary (R-7, R-8).
+  The constant doesn't even match its own comment (cites an 816 px page, uses
+  900).
+- **Exactly one component is responsive today** (`AtHomeTab`). Title bar and
+  status bar wrap-and-spill; several panels have fixed widths that break narrow;
+  the ribbon tab strip is below the 44 px touch minimum (R-13, R-14).
+
+**Readiness:** Spec 01 M4's *width* unification is done; **Spec 03 M1–M5 have not
+started.** No second width source must be introduced (Spec 03 §2).
+
+---
+
+## 2. Working Method §4.1 — the Blitz responsive surface (answered)
+
+| Question | Finding | Evidence |
+|---|---|---|
+| Do CSS `@media` width queries work / get used? | **Not used.** 0 occurrences in `loki-text`, `appthere-ui`, `loki-renderer`. Responsive behaviour must be driven programmatically off the measured `Viewport`. | `grep -rn "@media" --include=*.rs` → 0 |
+| `position: fixed`? | **Unsupported & unused.** Collapses to `absolute` in `stylo_taffy`. | `CLAUDE.md` "position: fixed … collapses to absolute"; 0 uses in scope |
+| `box-shadow`? | **Unused in scope.** (1 instance in `loki-presentation`, out of Text scope.) Elevation must come from border/background tokens. | 0 in `loki-text`/`appthere-ui`/`loki-renderer` |
+| CSS custom properties (`var(--`)? | **Unused.** Theming flows through the Rust token constants. | 0 `var(--` in scope |
+| `position: absolute`? | **Confirmed working** (block-level, in a positioned ancestor) — the spell panel relies on it. | `CLAUDE.md` 2026-06-28 note; `editor_spell_panel.rs` |
+
+**Conclusion (decides D1's emphasis):** the breakpoint must be a **programmatic
+signal**, not CSS media queries. This is also what keeps it testable without a
+real window (Spec 03 M1 acceptance) and aligns with the conformance-harness
+philosophy from Spec 02. CSS media queries are *not currently available* as even
+a secondary visual-tweak channel — if ever wanted, their support must be
+verified at runtime first and marked `// COMPAT(dioxus-native):`.
+
+---
+
+## 3. Spec 01 dependency status (read with Spec 03 §2)
+
+| Item | Status | Detail / file |
+|---|---|---|
+| **One width source, not two** | ✅ **Landed** | The stale `window_width` (defaulted 1280, never written) is deleted; everything reads the measured `scroll_metrics.client_width` via `Viewport`. Writer: `editor_canvas.rs:256` (`onscroll` → `client_width`). Readers: `editor_pointer.rs`, `editor_keydown.rs`, `document_view.rs`. |
+| **`Viewport` type exists** | ✅ **Landed (minimal)** | `loki-text/src/editing/viewport.rs` — `struct Viewport { inner_width_px: f32 }` + `new` + `centred_origin_x`. |
+| **`Viewport` carries zoom / DPI / page geometry** | ❌ **No** | Only `inner_width_px`. The type's own doc comment says *"zoom / DPI can join this type when Spec 03 (Responsive) needs them"* and page geometry stays in `DocumentState`. **D2 (page-fit) needs zoom + page geometry on/through this type — R-2.** |
+| **`LayoutContext`** | ❌ **Not created** | The Spec 01 audit mentioned `Viewport`/`LayoutContext`; only `Viewport` exists. No blocker — Spec 03 builds on `Viewport`. |
+| **`Viewport` lives in shared UI infra** | ❌ **No — app layer** | It is in `loki-text/src/editing/`. Spec 03 §5.3 requires the breakpoint (and ideally the viewport) be shared so Presentation/Spreadsheet inherit it. **R-3.** |
+| **Design tokens & the uphill-edge fix** | ✅ **Landed** | Tokens in `appthere-ui/src/tokens/` (`colors`/`layout`/`spacing`/`typography`). `loki-renderer` no longer depends on `appthere_ui`; geometry tokens are injected via props. The breakpoint classification should sit *alongside* these tokens. |
+
+**Directive for the implementer (Spec 03 §2):** do **not** add a third width
+signal. Extend the existing `Viewport` (zoom/DPI) and *relocate* it + the new
+`Breakpoint` into shared UI, rather than re-measuring.
+
+---
+
+## 4. Threshold fragmentation (the M1 unification target)
+
+Three independent magic numbers already gate "responsive" behaviour, none of
+them agreeing:
+
+| Constant | Value | Used by | File |
+|---|---|---|---|
+| `BREAKPOINT_DESKTOP_PX` | **768** | `AtHomeTab` row↔column switch (the *only* responsive component) | `appthere-ui/src/tokens/layout.rs:66` |
+| `REFLOW_BREAKPOINT_PX` | **900** | paginated↔reflow renderer default | `loki-text/.../editor_inner.rs:77` |
+| Spec 03 proposed tiers | **600 / 1024** | (not yet implemented) | spec §5.1 |
+
+The 900 constant's own comment justifies it by "a US-Letter page (~816px) plus
+margins no longer fits" — i.e. it is reaching for a **page-fit** rule (D2) but
+hard-coding a guess instead (R-7). M1 should replace 768 and 900 with the
+single derived `Breakpoint`, and M2 should replace 900 with a real page-fit
+computation. **R-4.**
+
+---
+
+## 5. Misbehavior inventory (Working Method §4.2)
+
+Verdict legend: **OK** (adapts/scrolls sensibly) · **SPILL** (wrap-and-spill or
+overflow) · **WASTE** (wastes vertical/horizontal space when narrow) ·
+**FIXED** (fixed dimension breaks narrow) · **TOUCH** (sub-44 px target).
+
+| # | Surface | File | Layout today | Narrow (<600) verdict |
+|---|---|---|---|---|
+| R-9 | **Font-substitution warning** | `loki-text/.../editor_inner.rs:779–861` | full-width `flex-direction: row`, space-between | **SPILL / WASTE** — never stacks; long message wraps into a tall band (the named offender) |
+| R-13a | **Title bar** `AtTitleBar` | `appthere-ui/.../title_bar.rs:72–174` | `flex row`, centred title `flex:1`, right-side app name + collaborator badge | **SPILL** — no width guard; right cluster wraps when narrow |
+| R-13b | **Status bar** `AtStatusBar` | `appthere-ui/.../status_bar.rs:46–167` | `flex row`, fixed 16px gaps, left/right sections, height 24px | **WASTE/SPILL** — rigid; no reflow; content crowds/clips when narrow |
+| R-13c | **Tab bar** `AtTabBar` | `appthere-ui/.../tab_bar.rs:70–175` | `flex row`, `overflow-x: auto` | **OK** — horizontal scroll |
+| R-13d | **Home tab** `AtHomeTab` | `appthere-ui/.../home_tab/mod.rs:70–231` | row↔column at 768 px | **OK** — *the only responsive component* |
+| R-13e | **Ribbon** (strip/content/group/button/select) | `appthere-ui/.../ribbon/*` | `flex row` + `overflow-x: auto`; buttons 44×44; select fixed **180px** | **OK (scroll)** except **FIXED** select width; *responsive collapse is Spec 04's* |
+| R-14 | **Ribbon tab strip height** | `appthere-ui/.../ribbon/tab_strip.rs` | strip height **36px** | **TOUCH** — below 44 px (documented TODO in the file) |
+| R-13f | **Spell suggestion panel** | `loki-text/.../editor_spell_panel.rs:37–201` | `position: absolute`, 300px, clamped to viewport | **OK** (horizontal clamp); item touch height unverified |
+| R-13g | **Metadata panel** | `loki-text/.../editor_metadata_panel.rs:40–155` | docked, form rows with **fixed 140px** label | **FIXED** — label+input clip/wrap below ~250 px |
+| R-13h | **Language panel** | `loki-text/.../editor_language_panel.rs:28–168` | docked, fixed height 200px, space-between rows | **OK-ish** — wraps if space allows; action-button touch unverified |
+| R-13i | **Document tab** `AtDocumentTab` | `appthere-ui/.../document_tab.rs:90–159` | `max-width: 140px`, ellipsis | **OK** — truncates; scrolls in the tab bar |
+
+**Global:** no media queries, no breakpoint framework, no `compact`/`is_narrow`
+conditionals outside `AtHomeTab`. Touch targets are 44 px almost everywhere
+(WCAG 2.5.8 is documented per-component) — the exception is the ribbon tab strip
+(R-14) and three unverified panel action-button heights (R-15).
+
+---
+
+## 6. Font-substitution warning — current state (M3 baseline)
+
+| Aspect | Today | Gap vs Spec 03 §7 |
+|---|---|---|
+| Form | Inline full-width `flex row` band, `editor_inner.rs:779–861` | Needs compact-by-default chip + expand-on-demand (D3) |
+| Narrow layout | Wraps in place; never stacks | Needs vertical card stack at Compact |
+| Data | `FontResources.substitutions: HashMap<String, Option<String>>` (`Some` = substitute, `None` = no substitute) — `loki-layout/src/font.rs:36` | Sufficient for missing→substitute→action, but… |
+| Severity | **None** — metric-compatible (Carlito↔Calibri) and material fallbacks are formatted identically | D3 wants severity-aware styling; needs a signal on the substitution result |
+| Dismiss | Yes — `dismiss_font_warning: Signal<bool>`, cleared on new doc, persists across tab restore | OK; D3 also wants… |
+| Recovery | **None** — once dismissed it's gone until reload | Needs a persistent status-bar indicator to recover |
+| i18n | ✅ `fl!()`, keys `editor-font-substitution-*` in `editor.ftl:45–48` | Add keys for the new chip/cards |
+| Blitz-clean | ✅ no fixed/shadow/custom-props | Maintain |
+
+Download links are a **hardcoded per-font** map in the component
+(`editor_inner.rs`); the redesign should keep the link source but move
+presentation to the card's action slot.
+
+---
+
+## 7. Renderer switch — current state (M2 baseline)
+
+- **Enums:** `ViewMode { Paginated, Reflow }` (`document_view.rs:32–41`);
+  `RenderMode { Paginated, Reflow { available_width_pt } }`
+  (`render_layout.rs:40–50`); `LayoutMode { Paginated, Pageless, Reflow {…} }`
+  (`loki-layout/src/mode.rs:15–33`).
+- **Decision (R-7):** `editor_inner.rs:635–643` — `width < REFLOW_BREAKPOINT_PX
+  (900)` → `Reflow`, else `Paginated`; frozen once the user toggles
+  (`view_mode_user_set`). **Width-only**: ignores zoom, DPI, and the document's
+  own page width/margins. Android-CPU builds hard-pin `Reflow`.
+- **Hysteresis (R-8):** there is a 0.5 pt tolerance on *reflow width* changes
+  (`RenderMode::matches`, `render_layout.rs:52–69`) so sub-pixel jitter doesn't
+  relayout — but **no dead-band around the 900 px mode boundary**, so a window
+  dragged across it thrashes between renderers. D2 requires the dead-band.
+- **D2 target:** compute page-fit from `Viewport` (width + zoom + DPI + page
+  geometry) — which means R-2 (put zoom/DPI on/through `Viewport`) is a
+  prerequisite for M2.
+
+---
+
+## 8. Non-paginated typography — current state (M4 baseline)
+
+- **GPU reflow path** (the real layout engine, what most users see): content
+  width = `viewport − 2×REFLOW_PADDING_PT` (≈ viewport − 48 CSS px), **no
+  max-width cap** → an unbounded measure that runs the full width and reads
+  **cramped** on small screens. Confirms Spec 03 §8. (`render_layout.rs:28–30`,
+  `loki-layout/src/mode.rs:24–32`.) **R-6.**
+- **Android-CPU HTML fallback** (low-fidelity, no caret): already caps at
+  `max-width: 820px; margin: 0 auto` (`reflow_view.rs:174–176`) — so the
+  *fallback* is bounded but the *primary* path is not. The fix belongs on the
+  GPU/layout path.
+- M4 wants: bounded measure (~45–75 ch), tuned vertical rhythm, a
+  `Breakpoint`-driven type scale, and min/max-bounded reflow.
+
+---
+
+## 9. Where the breakpoint system should live (Spec 03 §5.3 / ADR 0009)
+
+- `Viewport` is currently app-layer (`loki-text`). The `Breakpoint`
+  classification and responsive context are **shared UI infrastructure** so
+  Presentation/Spreadsheet inherit them.
+- **Recommendation (for triage):** place the `Breakpoint` enum + the
+  `viewport → Breakpoint` derivation **in `appthere-ui`, alongside the design
+  tokens** (`appthere-ui/src/tokens/layout.rs` already holds
+  `BREAKPOINT_DESKTOP_PX`, and `appthere-ui` is the shared, downhill UI crate
+  after the Spec 01 uphill-edge fix). Relocating `Viewport` itself into
+  `appthere-ui` (or a foundation crate it re-exports) lets the three apps share
+  one width source. Final placement follows ADR 0009's layer map — flag if the
+  dependency-direction gate (`scripts/check-dependency-direction.py`) objects.
+- The classification must carry **no Text-specific assumptions** (Spec 03 §5.3).
+
+---
+
+## 10. Milestone readiness
+
+| Milestone | Prereqs present? | Blockers / first step |
+|---|---|---|
+| **M1 — Breakpoint foundation** | ✅ **Implemented** | Triaged → built: `Breakpoint` (Compact/Medium/Expanded @ 600/1024) + the relocated, zoom/DPI-extended `Viewport` live in `appthere-ui::responsive`; `AtResponsiveContext` + `use_breakpoint`/`use_viewport` expose it; the editor funnels its one measured width into it (no second source). 11 window-free unit tests (R-2, R-3, R-4, R-5 resolved). |
+| **M2 — Page-fit switch** | ✅ **Implemented** | `appthere_ui::responsive::resolve_page_fit` decides paginated↔reflow from page-fit (page width × `viewport.zoom` + gutter vs measured width), hysteretic (`PAGE_FIT_HYSTERESIS_PX` dead-band). The `900` guess is gone; the editor's effect now reads the document's real `page_width_px`. 6 window-free tests incl. landscape-phone-fits, narrow-desktop-doesn't, and a no-thrash drag sweep (R-7, R-8 resolved). Zoom is fixed at 100% until zoom lands, but the rule already scales by `viewport.zoom`. |
+| **M3 — Font-warning redesign** | ✅ **Implemented** | New `editor_font_warning::FontWarning` component: compact chip by default (`N fonts substituted`), expand-on-demand into a **breakpoint-aware** view — a table on Expanded, a vertical card stack on Compact (uses M1's `use_breakpoint`). Severity model (metric-compatible vs material fallback) styles the badge; dismiss + a generic status-bar recovery chip (`AtStatusBar.notice_*`); `fl!()` strings; Blitz-clean (border/background, no fixed/shadow/custom-props). 3 unit tests for the severity/link/sort logic. Extracted from `editor_inner` (1002→878). R-9/R-10/R-11/R-12 resolved. |
+| **M4 — Non-paginated typography** | ✅ **Implemented** | The GPU reflow measure is now **bounded** at `MAX_REFLOW_TILE_PX = 820` (the HTML-fallback precedent) and **centred** (the renderer's `margin: auto` centres the capped tile). A single shared `render_layout::{reflow_tile_width_px, reflow_content_width_pt}` drives paint, hit-test, and keyboard nav so they stay aligned (Spec 01 discipline); the HTML fallback references the same constant. Narrow screens still use full width; wide windows cap & centre. 3 unit tests. R-6 resolved. **Responsive *type scale* deferred** — rescaling the document's own point sizes is a fidelity concern; the bounded+centred measure is the readability fix. |
+| **M5 — Cross-UI sweep** | ✅ **Implemented** | `use_breakpoint` made **resilient** (defaults to Expanded when an app hasn't wired the context, so shared shells can adapt without panicking). **AtTitleBar** hides the redundant top-right app-name at Compact; **AtStatusBar** drops the secondary word-count + language labels at Compact — the two wrap-and-spill cases (R-13a/R-13b) are cleared. Panel action buttons (metadata, language) bumped to `TOUCH_MIN` (R-15). **Deferred (documented):** metadata-panel label *stacking* only matters below ~250 px (sub-phone) and the panels render conditionally (can't host a hook) — a follow-up; ribbon select width (R-13e) + tab-strip touch height (R-14) are **Spec 04** (ribbon) as the spec directs. |
+
+---
+
+## 11. Finding register
+
+| ID | Severity | Finding | Anchor |
+|---|---|---|---|
+| R-1 | Info | Blitz: no `@media`/`fixed`/`box-shadow`/`var(--` in scope → programmatic breakpoint is the only viable source of truth (confirms D1) | §2 |
+| R-2 | ~~High~~ **Resolved (M1)** | `Viewport` now carries `zoom` + `dpi` (default 1.0 / 96); M2 page-fit will populate them. | §3 |
+| R-3 | ~~High~~ **Resolved (M1)** | `Viewport` + `Breakpoint` relocated to `appthere-ui::responsive` (shared infra); `loki-text` re-exports `Viewport` for path stability. | §3, §9 |
+| R-4 | ~~High~~ **Resolved (M1)** | One `Breakpoint` (600/1024). `BREAKPOINT_DESKTOP_PX = 768` deprecated to `AtHomeTab` only (M5 reconciles); `900` stays the renderer threshold until M2's page-fit replaces it. | §4 |
+| R-5 | Info | Spec 01 M4 *width* unification landed; `LayoutContext` never created (not a blocker) | §3 |
+| R-6 | ~~High~~ **Resolved (M4)** | GPU reflow measure bounded + centred at `MAX_REFLOW_TILE_PX` (820) via shared `render_layout` functions used by paint/hit-test/keyboard nav; HTML fallback references the same constant. | §8 |
+| R-7 | ~~High~~ **Resolved (M2)** | Renderer switch now follows page-fit (page width × zoom + gutter vs measured width), reading the document's real `page_width_px`; the `900` guess is deleted. | §7 |
+| R-8 | ~~Med~~ **Resolved (M2)** | `resolve_page_fit` is hysteretic on the current mode (`PAGE_FIT_HYSTERESIS_PX` dead-band); a no-thrash drag sweep test guards it. | §7 |
+| R-9 | ~~High~~ **Resolved (M3)** | Warning is now compact-by-default (a chip) and never a full-width band; expands on demand. | §6 |
+| R-10 | ~~Med~~ **Resolved (M3)** | Expanded view stacks as cards at Compact and a table at Expanded (`use_breakpoint`). | §6 |
+| R-11 | ~~Med~~ **Resolved (M3)** | Severity model: metric-compatible substitutes styled calmly, material fallbacks prominently (UI heuristic; removal condition documented for when the engine exposes severity). | §6 |
+| R-12 | ~~Med~~ **Resolved (M3)** | Dismiss is recoverable via a generic `AtStatusBar` notice chip that restores the warning. | §6 |
+| R-13 | **Resolved (M5) / partial** | Title bar + status bar SPILL/WASTE **fixed** (hide secondary chrome at Compact). Metadata-panel label *stacking* (R-13g) deferred — functional at phone widths, only clips sub-phone; ribbon select 180 px (R-13e) is Spec 04. | §5 |
+| R-14 | **Deferred → Spec 04** | Ribbon tab strip touch height is a ribbon concern (Spec 04, which consumes the M1 breakpoint). | §5 |
+| R-15 | **Resolved (M5)** | Metadata + language panel action buttons bumped to `TOUCH_MIN` (44 px). | §5 |
+
+---
+
+## 12. Open questions for maintainer triage
+
+1. **Breakpoint tiers.** Adopt Spec 03's 600/1024, or reconcile with the
+   existing 768 (home tab) and 900 (renderer)? The renderer's 900 is really a
+   page-fit proxy and should be *replaced* by M2's computation, not folded into a
+   tier — confirm.
+2. **Crate placement (R-3).** Put `Breakpoint` (and relocate `Viewport`) into
+   `appthere-ui` alongside tokens, or introduce a dedicated foundation crate the
+   three apps + `appthere-ui` share? Either must satisfy
+   `check-dependency-direction.py`.
+3. **`Viewport` extension (R-2).** Add `zoom` and `dpi` (and a page-geometry
+   accessor) to `Viewport` now (needed for M2), even though Spec 01 deferred
+   them — confirm this is the intended Spec 03 home for zoom.
+4. **Sequencing.** M1 → M2 (M2 depends on R-2) → M3/M4 (independent, parallel) →
+   M5 sweep. Run audit-first per finding like Spec 01/02, or batch the
+   foundation (M1+M2) first?
+5. **Testability.** Mirror Spec 02's harness style — pure `viewport.width →
+   Breakpoint` and page-fit unit tests with no window — for the M1/M2 acceptance
+   criteria?
+
+No code has been changed. Awaiting triage before implementing M1.
diff --git a/docs/adr/spec-03-responsive-ui-foundation.md b/docs/adr/spec-03-responsive-ui-foundation.md
new file mode 100644
index 00000000..228906df
--- /dev/null
+++ b/docs/adr/spec-03-responsive-ui-foundation.md
@@ -0,0 +1,184 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 03 — Responsive UI Foundation
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation |
+| **Scope** | AppThere Loki (Text); the breakpoint system is designed as shared monorepo UI infrastructure |
+| **Sequence** | 3 of 6 — establishes the responsive foundation the Ribbon and Styling Panel build on |
+| **Depends on** | Spec 01 (the unified `Viewport`/`LayoutContext` from M4; ADR 0009 layering; design-token location after the uphill-edge fix) |
+| **Feeds** | Ribbon (Spec 04 consumes the breakpoint system), Styling Panel (Spec 05 must survive the Compact breakpoint) |
+
+---
+
+## 1. Context & Motivation
+
+Loki runs on desktop and phone today, but it does so by looking *mostly the same at every size and scrolling whatever overflows*. There is no breakpoint system: the layout doesn't adapt, it just spills. The named offender is the **font-substitution warning** — a full-width horizontal band of explanatory text that, on a phone, wraps several times and consumes a large amount of vertical space while laying out illogically for the narrow viewport. But the warning is a symptom; the whole UI needs to be brought up to a deliberate standard of responsive design.
+
+This spec establishes that foundation:
+
+1. A **breakpoint system** with real viewport detection, derived from the single `Viewport` source of truth Spec 01 creates — not a new width source.
+2. A principled rule for the **paginated ↔ non-paginated** renderer switch, tied to whether a page actually fits rather than to a device guess.
+3. A **redesigned font-substitution warning** that is compact by default and lays out sensibly when narrow.
+4. **Typographic polish** for the non-paginated view, which currently renders cramped.
+5. A **cross-UI responsive sweep** applying the new foundation to every surface.
+
+The breakpoint system is **shared monorepo UI infrastructure**: Presentation and Spreadsheet need responsive behavior too, so the classification lives in the shared UI layer and all three apps consume it. This spec implements and proves it in Text.
+
+This is **audit-first**. Before building, the implementing agent confirms what Blitz actually supports for responsive layout (media queries vs. programmatic), locates the current font-warning component and the paginated/non-paginated switch, and inventories every surface that misbehaves when narrow. References below are illustrative.
+
+---
+
+## 2. Relationship to Spec 01 (read this first)
+
+Spec 01's audit established the load-bearing fact this spec depends on: **the app already measures the real viewport** via the patched `get_client_rect()`, storing it in `scroll_metrics.client_width` where it feeds reflow — while hit-test/pointer math reads a *separate*, never-written `window_width` signal defaulted to 1280. Spec 01 M4 unifies those into one `Viewport`/`LayoutContext`.
+
+Therefore this spec **does not create or re-specify a width source.** It builds the breakpoint classification *on top of* the unified `Viewport`. If Spec 03 implementation begins before Spec 01 M4 lands, the agent must not introduce yet another width signal — it derives the breakpoint from whatever the current best measured width is and flags the dependency, so the two specs converge on one source rather than adding a third.
+
+Layering and the dependency-direction invariant come from **ADR 0009**; this spec cites it rather than re-proposing a layering. Design tokens are consumed from wherever Spec 01's uphill-edge fix relocates them (the `loki-renderer → appthere_ui` token edge); this spec points at that location, it does not assume the old one.
+
+---
+
+## 3. Goals / Non-Goals
+
+**Goals**
+
+- A `Breakpoint` derived from the unified `Viewport`, exposed as a responsive context/signal to UI components, shared across the three apps.
+- A page-fit-driven paginated↔non-paginated switch.
+- A font-substitution warning that is compact-by-default, expand-on-demand, dismissible-but-recoverable, and stacks vertically when narrow.
+- A non-paginated view with a constrained measure and a responsive type scale.
+- Every UI surface audited and fixed for Compact-width behavior, with adequate touch targets.
+
+**Non-Goals**
+
+- Pinch-to-zoom (helpful, not immediately necessary; deferred, but the architecture must leave room — zoom is a `Viewport` property).
+- The `Viewport` unification itself (→ Spec 01 M4; consumed here).
+- Ribbon responsive *collapse* behavior (→ Spec 04; Spec 03 *provides* the breakpoint system Spec 04 consumes).
+- The substitution *engine* and its tests (→ Spec 02; this spec owns only the warning *UI*).
+- New chrome features; this is adaptation and polish, not new surfaces.
+
+---
+
+## 4. Working Method
+
+1. **Confirm the Blitz responsive surface.** Determine empirically what the current Blitz/Stylo build supports: do CSS media queries on width work reliably, or must responsive behavior be driven programmatically off the measured viewport? Record the answer — it decides D1's emphasis. Note the standing Blitz constraints that shape every layout choice below: **no `position: fixed`, no `box-shadow`, no CSS custom properties.**
+2. **Inventory misbehavior.** Catalogue every surface that wraps, overflows, or wastes space when narrow — the font warning first, then status bar, tab bar, title bar, panels, dialogs.
+3. **Build the breakpoint context** atop the unified `Viewport`.
+4. **Implement** the page-fit switch, the warning redesign, and the non-paginated typography.
+5. **Sweep** the inventoried surfaces against the new foundation.
+
+Standing standards (ADR 0009, Spec 01 conventions) apply throughout; flag deviations rather than conforming silently.
+
+---
+
+## 5. The Breakpoint System
+
+### 5.1 Semantic, not device-named
+
+Breakpoints are **semantic window-size classes**, not device names, because device names lie — tablets, split-screen windows, and large phones in landscape all straddle the categories, and two windows of equal width should behave identically regardless of the hardware they're on. Proposed tiers (to be confirmed against the inventory):
+
+| Class | Width | Intended posture |
+|-------|-------|------------------|
+| **Compact** | < 600 | Single column, touch-first chrome, non-paginated, stacked panels |
+| **Medium** | 600–1024 | Transitional; page-fit decides paginated/non-paginated; panels may overlay |
+| **Expanded** | ≥ 1024 | Paginated, full chrome, side-by-side panels |
+
+The classification is derived state: `Viewport.width → Breakpoint`. It is exposed once, via context/signal, so no component re-measures or re-derives.
+
+### 5.2 Source of truth
+
+The `Breakpoint` is computed **only** from the unified `Viewport` (§2). Where Blitz reliably supports CSS media queries, components may use them for purely-visual adjustments — but the programmatic `Breakpoint` signal is the **single source of truth** for any behavior that must be testable (panel collapse, renderer choice, ribbon adaptation). This keeps responsive logic verifiable in the conformance harness without a real window, and independent of how complete Blitz's CSS media-query support turns out to be.
+
+### 5.3 Where it lives
+
+`Viewport` is foundation-layer (Spec 01). The `Breakpoint` classification and the responsive context are **shared UI infrastructure** so Presentation and Spreadsheet inherit them; exact crate placement follows ADR 0009's layering (likely the shared UI crate alongside the relocated design tokens). It must carry no Text-specific assumptions.
+
+---
+
+## 6. Paginated ↔ Non-Paginated Switch
+
+Loki ships two renderers and currently picks between them by a rough size guess. The correct trigger is **content fit, not device class**:
+
+**Decision (D2): switch on whether a page column fits.** Use paginated rendering when a full page width (page size + margins + surrounding chrome) fits at the current zoom; otherwise use the non-paginated renderer to avoid horizontal scrolling. This is computed from the `Viewport` (width, zoom, DPI, page geometry — all already on that type), *not* from the raw `Breakpoint`. A large phone in landscape that can fit a page gets pagination; a narrow split-screen desktop window that can't gets the non-paginated view. The `Breakpoint` still informs *chrome* posture; the *renderer* follows page-fit.
+
+The two interact but are not the same axis, and conflating them is what produces wrong behavior at the edges. The switch must be hysteretic — a small dead-band around the threshold — so a window dragged to exactly the boundary doesn't thrash between renderers.
+
+---
+
+## 7. Font-Substitution Warning Redesign
+
+### 7.1 Current state & the problem
+
+Today the warning is a full-width horizontal band carrying a long explanatory message: which requested fonts weren't resolved, which substitutions were made, and a link to download the originals where the link is known. On a phone this text wraps repeatedly into a tall block, wasting vertical space and laying out illogically for the viewport.
+
+### 7.2 Redesign
+
+**Decision (D3): compact-by-default, expand-on-demand, dismissible-but-recoverable, vertical-stack when narrow.**
+
+- **Default state:** a compact indicator, not a paragraph — e.g. a single concise line or chip ("3 fonts substituted") with an icon. It states the fact and offers to expand. Localized via `fl!()` like all user-facing strings.
+- **Expanded state:** a structured **missing → substitute → action** view. On Expanded width this can be a compact table; on Compact width it becomes a **vertical stack of cards**, one per substitution, each showing the requested font, the substitute used, and a download-original action where a link is known. No horizontal band that wraps.
+- **Severity awareness:** a metric-compatible substitution (Carlito for Calibri — the §7.3 set from Spec 02) is low-concern and can be styled calmly; a fallback that materially changes metrics is higher-concern and surfaced more prominently. This reuses the substitution-engine signal Spec 02 exercises; the warning is its UI.
+- **Dismissible but recoverable:** the user can dismiss it (remembered per document), and recover it from a persistent, unobtrusive indicator (e.g. in the status bar) so dismissing isn't losing the information.
+- **Blitz-aware presentation:** no `position: fixed` (the indicator lives in document/chrome flow, not pinned to the viewport), no `box-shadow` (elevation via border/background from the token set), no custom properties (theming through the token system at its post-Spec-01 location).
+
+---
+
+## 8. Non-Paginated View Typography
+
+The non-paginated view exists to reduce horizontal scrolling on small screens, but it currently renders **cramped**, which is a readability bug.
+
+**Decision (D5): constrained measure + responsive type scale.**
+
+- **Bounded measure:** cap line length to a comfortable reading measure (roughly 45–75 characters) rather than letting text run the full viewport width; center the column with breathing room when the viewport exceeds the measure.
+- **Adequate vertical rhythm:** line-height, paragraph spacing, and margins/padding tuned for reading, not packed.
+- **Responsive scale:** type and spacing scale sensibly across `Breakpoint` classes so Compact isn't a shrunk Expanded.
+- **Reflow within bounds:** reflow to viewport width with min/max bounds, so the view stays readable from phone to wide window.
+
+This view is what most users see on Compact, so its polish disproportionately affects perceived quality.
+
+---
+
+## 9. Cross-UI Responsive Sweep
+
+With the foundation in place, apply it to every surface the §4 inventory flagged. At minimum: status bar, tab bar (`AtTabBar`), title bar (`AtTitleBar`), status bar (`AtStatusBar`), any dialogs/panels, and the home/document surfaces. Each must: lay out logically at Compact (stack, don't wrap-and-spill), present **touch-sized targets** (≈44px minimum) when the breakpoint is touch-first, and respect the Blitz constraints. The Ribbon is explicitly handed to Spec 04, which consumes this spec's breakpoint system rather than reinventing it.
+
+---
+
+## 10. Key Decisions (ADR-style)
+
+**D1 — Programmatic breakpoint signal is the source of truth.** Derived from the unified `Viewport`; CSS media queries used only for purely-visual tweaks where Blitz supports them. Rationale: testable without a window, independent of Blitz CSS completeness, reuses existing measurement. Tradeoff: some adaptation is in Rust rather than CSS — accepted for verifiability.
+
+**D2 — Renderer switch follows page-fit, not breakpoint.** Content fit is the right trigger; device class is a proxy that's wrong at the edges. Hysteresis prevents thrash. Tradeoff: a slightly more involved computation than a width threshold — worth it for correct edge behavior.
+
+**D3 — Warning is compact-by-default and stacks when narrow.** Directly fixes the named vertical-space problem; dismissible-but-recoverable preserves the information. Tradeoff: an expand interaction the old band didn't have — accepted; the band's "always fully expanded" was the bug.
+
+**D4 — Semantic window-size classes, not device names.** Equal-width windows behave equally; categories don't break on tablets/split-screen. Tradeoff: names are less intuitive than "phone/tablet" — mitigated by documenting the mapping.
+
+**D5 — Non-paginated view gets a bounded measure and responsive scale.** Cramped text is a readability defect; bounded measure is basic typography. Tradeoff: text no longer uses full width on wide windows — that's the point.
+
+---
+
+## 11. Milestones & Acceptance Criteria
+
+**M1 — Breakpoint foundation.** Blitz responsive-surface question answered and recorded; `Breakpoint` derived from the unified `Viewport`; responsive context exposed; placed per ADR 0009 as shared UI infra. *Accept:* a width change produces the correct `Breakpoint` in a test without a real window; no second width source introduced.
+
+**M2 — Page-fit renderer switch.** Paginated↔non-paginated driven by page-fit with hysteresis. *Accept:* a landscape-phone-width that fits a page renders paginated; a narrow desktop window that doesn't renders non-paginated; dragging across the boundary doesn't thrash.
+
+**M3 — Font-warning redesign.** Compact indicator, expand-on-demand missing→substitute→action view, vertical-stack at Compact, dismiss + status-bar recovery, severity-aware styling, `fl!()` strings, Blitz-constraint-clean. *Accept:* on a Compact viewport the warning occupies a small fixed footprint and expands to a logical stacked layout, not a multiply-wrapped band; dismiss and recovery both work.
+
+**M4 — Non-paginated typography.** Bounded measure, vertical rhythm, responsive scale, bounded reflow. *Accept:* text in the non-paginated view holds a comfortable measure across Compact→Expanded and no longer reads cramped.
+
+**M5 — Cross-UI sweep.** Every inventoried surface adapted; touch targets sized at touch-first breakpoints. *Accept:* the §4 inventory is empty of wrap-and-spill cases; the Ribbon is left to Spec 04 but already consumes the M1 breakpoint system.
+
+---
+
+## 12. Out of Scope
+
+- Pinch-to-zoom (deferred; zoom remains a `Viewport` property so it can be added without rework).
+- The `Viewport` unification (→ Spec 01 M4).
+- Ribbon collapse/overflow behavior (→ Spec 04; it consumes the M1 breakpoint system).
+- The font-substitution *engine* and its conformance tests (→ Spec 02; this spec owns the warning UI only).
+- Styling-panel internals (→ Spec 05; it must survive Compact, which this spec's foundation enables).
diff --git a/docs/adr/spec-04-ribbon-audit.md b/docs/adr/spec-04-ribbon-audit.md
new file mode 100644
index 00000000..6b973f48
--- /dev/null
+++ b/docs/adr/spec-04-ribbon-audit.md
@@ -0,0 +1,470 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 04 — Ribbon UI Refinement: Audit Report
+
+| | |
+|---|---|
+| **Status** | Audit complete; triaged → **M1 (framework + rename) + M2 (labeled-group standardization) implemented**. M4 → M3 → M5/M6 next (triaged sequence). Q2 features (cut/copy/paste + find/replace) are real editor features with no existing backing — building them with their backing is the next focused step (no dead buttons). |
+| **Method** | Audit-first per Spec 04 §4: inventory the ribbon, run the render-capability audit (§10 — the committed capability table), and confirm the Blitz layout surface for the collapse engine. |
+| **Companion** | [spec-04-ribbon-ui-refinement.md](spec-04-ribbon-ui-refinement.md) (the design spec) |
+| **Precedent** | Same audit-then-triage flow as [spec-01](spec-01-audit-report.md) / [spec-02](spec-02-conformance-inventory.md) / [spec-03](spec-03-responsive-audit.md). |
+
+This report establishes ground truth and a finding register (RB-1 … RB-12). It makes
+**no code changes** — implementation waits for triage. The §4 **capability table**
+is the headline deliverable.
+
+---
+
+## 1. Executive summary
+
+- **The framework is more built than the spec assumed — the work is mostly *content*, not new framework.** The contextual-tab mechanism already exists (`RibbonTabDesc.is_contextual`, amber styling) but is unused; labeled groups already exist (`AtRibbonGroup.label: Option<String>`) — the Write/Home tab simply passes `None` (icon-only) while Publish passes `Some` (labeled). So **D1 (rename), D2 (labeled everywhere), and the contextual mechanism are largely a matter of using what's there** (RB-1).
+- **What's genuinely missing is the collapse engine.** Today the ribbon has only a collapse *toggle* (hide the whole content row) + `overflow-x: auto` scroll — no width-driven full→condensed→overflow cascade (RB-2). This is the real M3 build.
+- **The capability table (§4) is decisive:** 5 objects **Create-ready** (images, tables, headers/footers, hyperlinks, **footnotes**), 1 **Render-only** (math), 1 **Unsupported** (shapes). Notably the audit **upgrades footnotes** from the spec's seed ("renders to an extent") to *complete render* → Create-ready (RB-7), and **confirms math render-only / shapes unsupported** with code evidence (RB-8/RB-9).
+- **Blitz surface is sufficient:** a component can measure its **own** width via `onmounted`→`get_client_rect().await`, `use_viewport().inner_width_px` gives the px the width-driven engine needs, the overflow menu can use `position: absolute` (spell-panel precedent), and the `resolve_page_fit` hysteresis pattern (`PAGE_FIT_HYSTERESIS_PX = 48`) is the template for collapse hysteresis (RB-10).
+- **One spec correction:** the "existing bottom-ribbon-for-touch placement" **does not exist** — only safe-area-inset + Compact-detection infrastructure for it. M6 frames it "where applicable," so it stays optional (RB-11).
+
+**Readiness:** M1 (rename + framework polish), M2 (labeled groups), and M4 (Insert from the table) are low-risk and mostly content. M3 (collapse engine) is the substantive new build. **No code changed.**
+
+---
+
+## 2. Ribbon framework inventory (`appthere-ui/src/components/ribbon/`)
+
+| Component | File | Renders | Notes |
+|---|---|---|---|
+| `AtRibbon` | `mod.rs:84` | tab strip + content row shell | props: `tabs`, `active_tab`, `on_tab_select`, `collapsed`, `on_toggle_collapse`, `tab_content` |
+| `AtRibbonTabStrip` | `tab_strip.rs:31` | tab-label row + collapse button | height **36 px** (`RIBBON_TAB_STRIP_HEIGHT`, `tokens/layout.rs:65`) — **R-14** |
+| `AtRibbonContent` | `content_row.rs:26` | scrollable group row | `overflow-x: auto` (the only overflow today) |
+| `AtRibbonGroup` | `group.rs:28` | labeled section | `label: Option<String>` — **labeled groups already supported** |
+| `AtRibbonIconButton` | `button.rs:38` | 44×44 button | icon child *or* text-span child (labeled) — both styles already possible |
+| `AtRibbonSelect` | `select.rs:52` | style-picker dropdown | hardcoded `width: 180px` (`select.rs:73`) — **R-13e** |
+| `RibbonTabDesc` | `mod.rs:57` | `{ label, is_contextual, aria_label }` | **contextual mechanism already present** (`is_contextual`) |
+
+**Framework capabilities — present vs. missing:**
+
+| Capability | Status |
+|---|---|
+| Contextual-tab mechanism (`is_contextual`, amber styling) | ✅ present, **unused** by the app (no selection signal feeds it — RB-5) |
+| Labeled groups (`label: Some(..)`) | ✅ present, used only by Publish |
+| Labeled *buttons* (text span in `AtRibbonIconButton`, `label_node`) | ✅ present (Publish) |
+| Collapse **toggle** (hide content row) + horizontal scroll | ✅ present |
+| **Width-driven collapse cascade** (full→condensed→overflow) | ❌ **missing** — the M3 build (RB-2) |
+| **Overflow "more" menu** | ❌ missing |
+| Per-group **collapse priority** + condensed/overflow representations | ❌ missing |
+
+---
+
+## 3. Tab / group / control inventory
+
+| Tab | Idx | Style | Groups → controls |
+|---|---|---|---|
+| **Home** (→ Write) | 0 | **icon-only** (`label: None` everywhere) | Document (Save / Save As / Save as Template), History (Undo / Redo), Styles (`AtRibbonSelect` para style — the Spec 05 entry point), Paragraph (edit-style), Inline (Bold / Italic / Underline / Strike / Super / Sub) |
+| **Publish** | 1 | **labeled groups** (the target standard) | Export (PDF/X, EPUB — labeled buttons), Metadata (Edit metadata — labeled) |
+
+Tabs are composed in `editor_inner.rs` (the `AtRibbon { tabs: vec![…], tab_content: match … }`); Home content in `editor_ribbon.rs`, Publish in `editor_publish.rs`. i18n keys in `ribbon.ftl` / `publish.ftl`.
+
+**Mapping to the Spec 04 tab set (§9):** Write's existing groups (Document/History/Styles/Paragraph/Inline) map cleanly onto the proposed **Write** (Clipboard/Font/Paragraph/Styles/Editing); the existing controls are a subset — the spec's instruction "map, don't invent" holds. **Insert / Layout / References / Review** are net-new tabs whose *contents* are gated by §4 (Insert) and the existing model/render features (Layout/References/Review map to already-supported page geometry, footnotes, spelling, comments).
+
+---
+
+## 4. The render-capability table (committed deliverable — Spec 04 §10)
+
+For each insertable object: **Import** (mapper parses it), **Render** (layout + paint, evidenced by code + an ACID `TC-*` case + `fidelity-status.md`), **Create** (a model-construction path).
+
+| Object (model type) | Import | Render | Create | **Verdict** | Evidence |
+|---|---|---|---|---|---|
+| **Image** (`Inline::Image`) | ✅ | ✅ | ✅ cheap | **Create-ready** | import `docx/mapper/images.rs`; paint `loki-vello/src/image.rs:29` `paint_image`; ACID TC-DOCX-023/024. Create = construct `Inline::Image` + existing `loki-file-access` picker. |
+| **Table** (`Block::Table`) | ✅ | ✅ | ✅ cheap | **Create-ready** | import `docx/mapper/table.rs:25`; layout `loki-layout/src/flow.rs:1527` `flow_table`; ACID TC-DOCX-003…007. Create = build an n×m `Table`. |
+| **Header / Footer** (`PageLayout`) | ✅ | ✅ | ✅ moderate | **Create-ready** | layout `flow.rs:960` `assign_headers_footers` (per-page, PAGE/NUMPAGES live); ACID TC-DOCX-018 / TC-ODT-008; `fidelity-status.md` §1. Create = insert a `HeaderFooter { blocks }` into `PageLayout` (needs a small edit surface, not geometry). |
+| **Hyperlink** (`Inline::Link`) | ✅ | ✅ | ✅ cheap | **Create-ready** | import `docx/mapper/inline.rs:85`; renders as styled inline text; ACID TC-DOCX-022. Create = wrap selection in `Inline::Link(target)`; URL via text entry. |
+| **Footnote / Endnote** (`Inline::Note`) | ✅ | ✅ **complete** | ✅ cheap | **Create-ready** ⬆ | import `docx/mapper/inline.rs:260/267`; layout `flow.rs:1126` `flow_footnotes` (numbering, per-section restart, separator); ACID TC-DOCX-020 / TC-ODT-009; `fidelity-status.md` §1 row 16. **Audit upgrades the spec's "renders to an extent" → complete render.** Create = insert `Inline::Note(kind, blocks)`; auto-numbers. |
+| **Math** (`Inline::Math` / MathML) | ✅ | ✅ **partial** | ❌ needs input surface | **Render-only** | import `docx/mapper/inline.rs:141` (OMML→MathML); layout `loki-layout/src/math/` (`mod.rs`/`compose.rs`/`shape.rs` — fractions, scripts, radicals, fences); ACID TC-DOCX-026. **Known first-pass gaps** (matrices, n-ary, accents, full mathspacing — `fidelity-status.md` §1 row 24). **No create path** — authoring needs an equation-input surface → a **future spec**, not this Insert tab. |
+| **Shape** (DrawingML preset/freeform) | ❌ | ❌ | — | **Unsupported** | **No shape-geometry rendering anywhere** in `loki-layout`/`loki-vello` (the `math/shape.rs` is math-delimiter stretching, not DrawingML). DOCX drawings only reach the model as `Inline::Image` anchors. Shape support is a **future renderer spec** before any Insert control. |
+
+**Tally:** **5 Create-ready** · **1 Render-only** (math) · **1 Unsupported** (shapes).
+
+This satisfies M4's acceptance shape: every Insert control maps to a Create-ready row; math and shapes get **no control** (no dead UI); imported docs containing math/shapes still display (math renders; DOCX shapes fall back to image anchors).
+
+---
+
+## 5. Existing create/insert paths (for M4 reuse)
+
+No new model-construction is needed for the Create-ready set — the constructors + Loro mutation layer suffice:
+
+- **Image:** `Inline::Image` + `loki_file_access` picker (already used app-wide). No insert UI yet.
+- **Table:** build a `Table` from grid geometry. No insert UI yet.
+- **Header/Footer:** `PageLayout.header/footer` hold `Vec<Block>`; mutate via the Loro layer. Needs a small block-editor surface (the style-editor panel is a reusable pattern).
+- **Hyperlink:** `Inline::Link(target, display)` over the selection.
+- **Footnote/Endnote:** `Inline::Note(kind, blocks)` at the cursor; auto-numbered by `flow_footnotes`.
+- Mutation layers: `loki-doc-model/src/loro_mutation/{text,block,style}.rs`.
+
+### 5a. Live-model gap & the Loro-bridge extension (M4 prerequisite)
+
+The §4 capability table rates render/construct readiness, but M4 scoping surfaced
+a deeper constraint: the **live Loro CRDT** flattens or *opaquely* snapshots most
+structured inlines (`Inline::Image`/`Note`/`Field`) and blocks (`Table`,
+footnote bodies). An opaque block round-trips losslessly and renders, but is
+**not live-editable** — so an Insert control over it would produce a non-editable
+object, which Spec 04 forbids (no dead/inert UI). Only **Hyperlink**
+(a `MARK_LINK_URL` text mark) was genuinely create-ready in the live model.
+
+Per maintainer direction (*"do the Loro-bridge extension first"*), structured
+inlines are being migrated to native CRDT mappings before the Insert tab ships,
+one tested increment per turn:
+
+The shared mechanism is `inlines::write_inline_object`: a top-level structured
+inline is written as an `OBJECT_REPLACEMENT_CHAR` (U+FFFC) anchor carrying the
+object as a `serde`-JSON mark (registered `ExpandType::None`), decoded back on
+read by `inlines_read::decode_inline_object`; `opaque.rs` un-gates the variant
+at top level only. An object *nested* inside a wrapper/run is still flattened by
+the text path → its block stays opaque (no silent loss).
+
+- **✅ Inline image (top-level)** — native via `MARK_IMAGE`. The image is a live,
+  positioned, deletable inline; image-bearing paragraphs are no longer opaque.
+  Tests: `loro_bridge_opaque_tests::{inline_image_stored_natively_not_opaque,
+  nested_inline_image_stays_opaque_but_survives}`.
+- **✅ Footnote / endnote (top-level)** — native via `MARK_NOTE`. The note
+  *reference* is a discrete, deletable inline anchor; its `NoteKind` + block
+  body round-trip losslessly in the mark (the body is a snapshot payload, not
+  yet a live CRDT subtree). Tests: `footnote_stored_natively_not_opaque`,
+  `endnote_kind_survives_native_roundtrip`, `nested_footnote_stays_opaque_but_survives`.
+- **✅ Table (block-level)** — native `BLOCK_TYPE_TABLE` (`loro_bridge::table`).
+  Stored as a **structural skeleton** (`KEY_TABLE_SKELETON`: the `Table` with
+  cell blocks emptied — grid/col-specs, spans, cell & row props, borders,
+  caption, attrs) plus **live per-cell block lists** (`KEY_TABLE_CELLS`: one
+  CRDT container per cell, content via the shared block path). Cell *text* is
+  therefore real CRDT state — concurrent edits to different cells merge — and
+  the mapping recurses (a table nested in a cell is itself native). Structural
+  edits (add row, change span) still rewrite the skeleton blob → not yet
+  cell-structurally mergeable; full structural CRDT mapping is TODO. Tests:
+  `loro_bridge_table_tests` (7 cases: native storage, separate cell containers,
+  rich/empty cells, spans + props, nested table, positioning).
+
+**Bridge-extension status: complete for the M4 Insert set.** Image, footnote,
+hyperlink, and table all have live mappings; the Insert tab can now offer all
+four without inert/dead UI. *(Caveat: the editor's `loro_mutation` API addresses
+only top-level section blocks — creating/typing inside table cells and note
+bodies needs a nested-addressing extension to that layer; tracked separately
+from this bridge-representation work.)*
+
+### 5b. M4 Insert tab — increment 1 (Hyperlink) shipped
+
+The **Insert** ribbon tab now exists (Write · Insert · Publish), with its first
+control: **Link**. Dependency analysis reorders the Insert set by *what is
+useful today* without the deferred cell/note interior-editing work:
+
+- **Hyperlink & Image** are fully useful now — they need no interior editing
+  (the linked text already exists; an image displays on its own).
+- **Table & Footnote** insert objects whose cells / bodies cannot yet be typed
+  into (they await the `loro_mutation` nested-addressing extension), so adding
+  their Insert controls now would create can't-fill objects — deferred.
+
+Increment 1 ships **Hyperlink** end-to-end: `editor_insert::set_hyperlink`
+(reuses `editor_formatting::resolve_format_range` + `mark_text`/`MARK_LINK_URL`)
+applies/clears a link over the selection or word at the cursor; a small URL
+panel (`editor_insert_panel`, docked above the ribbon like the metadata panel)
+drives it. No dead buttons: the tab shows only the Link control. Tests:
+`editor_insert` unit tests (selection, word-at-cursor, clear, trim). The Link
+icon (`LUCIDE_LINK`) was added to `appthere_ui`.
+
+Refactor folded in: the spelling, language, and link panels were bundled into
+`editor_docked_panels::docked_panels` to keep `editor_inner` within its
+baselined 878-line ceiling rather than growing it.
+
+### 5c. M4 Insert tab — increment 2 (Image) shipped
+
+The Insert tab now has a **Media → Image** control alongside Links → Link.
+
+Key finding: the renderer decodes image bytes straight from a **`data:` URI** in
+the image's URL (`loki-vello::image::decode_data_uri` → `image::load_from_memory`,
+guessing the format from magic bytes) — there is **no separate media store**. So
+runtime insertion is fully native with existing primitives:
+
+- **Model**: new `loro_mutation::insert_inline_image` writes an
+  `OBJECT_REPLACEMENT_CHAR` anchor + a `MARK_IMAGE` JSON snapshot — the exact
+  bridge encoding from the Loro-extension work — so the image is a discrete,
+  deletable inline that round-trips. (`MutationError::Encode` added.)
+- **Editor**: `editor_insert::image_inline_from_bytes` detects the format from
+  bytes (PNG/JPEG/GIF/WebP/BMP), embeds them as a base64 `data:` URI, and sizes
+  the image from its intrinsic pixels (`cx_emu`/`cy_emu` at 96 DPI so layout
+  gives it a box). `insert_image_at_cursor` places it at the cursor focus.
+- **UI**: the Image button spawns the platform file picker
+  (`pick_file_to_open` → `token.open_read()`), builds the inline, inserts, and
+  reports via the status banner (success / unsupported-format / no-cursor /
+  error). `LUCIDE_IMAGE` icon added; `image` + `base64` deps added to `loki-text`.
+
+Tests: `editor_insert` unit tests (data-URI + intrinsic size, non-image
+rejected, discrete-image insertion, no-cursor no-op) and
+`loro_mutation::insert_inline_image` (round-trips, rejects non-image).
+
+Refactor folded in (ceiling): the self-contained **Save as Template** callback
+moved to `editor_save_callbacks`, keeping `editor_inner` under 878 (now 855).
+
+### 5d. Nested-addressing mutation extension — foundation shipped
+
+The mutation layer can now address content **inside table cells**, not just
+top-level section blocks. New `loro_mutation::nested`:
+
+- **`BlockPath`** (`root` global block index + `CellStep` descents) names a
+  block either at the top level or nested inside a table cell (recursively, in
+  the bridge's flat head → bodies → foot cell order). `BlockPath::block(i)`
+  resolves exactly like the flat API; `BlockPath::in_cell(root, cell, block)`
+  reaches a cell's paragraph.
+- Path-based text primitives `insert_text_at` / `delete_text_at` /
+  `mark_text_at` / `get_block_text_at` / `get_mark_at_path` resolve the target
+  `LoroText` through `KEY_TABLE_CELLS` and mutate it. Because the bridge rebuilds
+  each cell from those same live containers, edits **round-trip** through
+  `loro_to_document`. (`MutationError::InvalidBlockPath` added.)
+- Tests (`loro_mutation_nested_tests`, 7 cases): read/insert/delete/mark inside
+  a cell with round-trip, flat-path parity, and the two invalid-path errors
+  (descend into a non-table block; out-of-range cell).
+
+**Honest scope — what this does and does not unblock:**
+
+- ✅ **Table cell text** is now reachable and editable at the CRDT layer (cells
+  were already live containers from the table native mapping).
+- ✅ **Footnote/endnote bodies** — now addressable too (see §5e + §5f): the
+  `BlockPath` `PathStep::Note` descent reaches a note body's blocks, recursively
+  (a note inside a table cell is `[Cell, Note]`).
+- This is the *mutation-layer* foundation only. Driving it from the UI still
+  needs (a) layout to assign positions to cell paragraphs, (b) hit-test/cursor
+  to produce a nested position, and (c) `CursorState` to carry a `BlockPath`.
+  And the **Table Insert control** additionally needs a block-insert primitive
+  (insert a new `Block::Table` into a section).
+
+### 5e. Footnote/endnote body — live container (bridge) shipped
+
+Note bodies were previously a `serde`-JSON snapshot inside the `MARK_NOTE` mark
+(rendered but inert). They are now **live CRDT containers**, mirroring table
+cells:
+
+- The anchor's `MARK_NOTE` mark now carries a `(NoteKind, idx)` pair; the body
+  lives as a movable list of blocks under the block's new `KEY_NOTES` container
+  at `idx` (written via the shared block path, so nested formatting/objects
+  compose). Read back by walking `KEY_NOTES` (`loro_bridge::inline_objects` +
+  `inlines_read`).
+- The `idx` also **fixes a latent merge bug**: two adjacent footnotes used to
+  share an identical mark and collapse into one rich-text delta span; the
+  distinct `idx` keeps their anchors separate.
+- Footnote text is therefore editable/mergeable CRDT state, not a blob — the
+  representation half of "editable footnotes".
+
+Tests: `loro_bridge_note_tests` (4 cases) — body is a live container (not a
+blob), two adjacent footnotes keep distinct bodies, mixed footnote/endnote
+kind+order, and no notes container when there are no notes — plus the existing
+note round-trip tests still green. Refactor (ceiling): the inline-object write
+helpers moved to `loro_bridge::inline_objects`, keeping `inlines.rs` ≤ 300.
+
+### 5f. `BlockPath` note-descent — nested addressing complete
+
+`BlockPath` now addresses **both** container kinds uniformly. `CellStep` was
+generalised into a `PathStep` enum (`Cell { cell, block }` | `Note { note,
+block }`); `descend` resolves either through `KEY_TABLE_CELLS` or `KEY_NOTES`.
+New constructor `BlockPath::in_note(root, note, block)`, and arbitrary `steps`
+support recursion — a footnote nested inside a table cell is `[Cell, Note]`.
+
+Tests (`loro_mutation_nested_tests`, now 12): the table-cell cases plus
+read/edit/round-trip inside a note body, addressing the correct note among
+several, the no-notes-container error, and **editing a note nested inside a
+table cell**. The path-based text/mark/get primitives are unchanged — they
+resolve through the generalised `descend`.
+
+The **mutation-layer nested-addressing story is now complete**: table cell text
+and footnote/endnote bodies are uniformly reachable, editable, and round-tripping.
+
+**Next increments (UI wiring):** cursor/hit-test must produce a nested position
+and `CursorState` must carry a `BlockPath`, and layout must assign positions to
+cell / note paragraphs — then the Table/Footnote Insert controls (Table also
+needs a block-insert primitive) can offer in-place editing.
+
+### 5g. Nested-editing UI wiring — architecture + staged plan
+
+Investigation of the editing pipeline (this is a large vertical; staging it to
+avoid risky half-built changes to the 1953-line `flow.rs`):
+
+**How editing addressing works today (all flat):** layout emits one
+`PageParagraphData { block_index, path, layout, origin }` per laid-out paragraph
+into `PageEditingData`; `hit_test` maps a click to that paragraph and returns a
+`DocumentPosition { page_index, paragraph_index = block_index, byte_offset }`;
+the editor mutates `paragraph_index` as a flat global block index.
+
+**Two findings that shape the work:**
+- **Table cells are laid out in a throwaway `temp_state`** (`flow::measure_cell_height`)
+  used only to measure height — cell paragraphs never reach the main flow's
+  editable `current_paragraphs`. Emitting their editing data (with a `[Cell]`
+  path and page-relative origins) is the substantive part.
+- **Footnote bodies *do* flow into `current_paragraphs`, but with `block_index =
+  0`** (`flow_footnotes` passes `0`). That is a *latent hit-test bug*: clicking a
+  footnote body today targets block 0. Giving them the correct root + `[Note]`
+  path fixes it.
+
+**Staged plan:**
+1. **Producer seam (this increment):** `PageParagraphData.path: Vec<PathStep>`
+   (empty for top-level). All existing emitters set it empty via a new
+   `push_editing_para` helper. No behaviour change.
+2. ✅ **Position seam (shipped):** `DocumentPosition` gains `path: Vec<PathStep>`
+   (empty = flat) + a `top_level(..)` constructor and `block_path()`; `hit_test`
+   carries `para_data.path`; `CursorState::block_path()` yields a `BlockPath`.
+   All ~15 production + test construction sites migrated; same-paragraph
+   navigation preserves the path, cross-paragraph (top-level) clears it
+   (`TODO(nested-nav)` for in-container sibling navigation). Unit tests cover
+   flat vs. nested `block_path()`. Top-level editing unchanged.
+3. **Layout emission:** emit `PageParagraphData` for table-cell paragraphs (real
+   flow, page-relative origins, `[Cell]` path) and fix footnote bodies to carry
+   `[Note]` + the owning block index.
+   - ✅ **Footnote bodies (shipped):** `CollectedNote` now records its
+     `owner_block_index` + `note_in_block` (set in `flow_paragraph`); a
+     `FlowState.nested_editing` context (in the new `flow_editing` module, with
+     `push_editing_para`) makes `flow_footnotes` tag each body paragraph with the
+     owner block + a `PathStep::Note`. This **fixes the latent `block_index = 0`
+     bug**. Test: `footnote_editing_tests`. *(Multi-paragraph note bodies are
+     addressed per body block; a note body containing a table is a known edge —
+     the inner cell paragraphs inherit the note context.)*
+   - ✅ **Table cells (shipped):** the non-rotated cell path already flows cell
+     blocks into the *main* state (only the block index/path were wrong), so a
+     per-cell `NestedEditing::cell` context (keyed by a `cell_flat` counter that
+     walks rows in the bridge's `head → bodies → foot` order) now tags each cell
+     paragraph with the table's block + a `PathStep::Cell`. Test:
+     `table_cell_editing_tests`. **Known limits:** rotated cells (laid out via
+     `flow_cell_blocks`/`temp_state`) don't yet emit editing data (see
+     increment 5); and a table nested in a cell/note doesn't yet compose paths.
+     *(The vertically-aligned cell caret-y offset is fixed in increment 5.)*
+
+   Increment 3 is **complete** for the common cases — clicks into top-aligned
+   table cells and footnote bodies resolve to the correct `BlockPath`.
+4. ✅ **Routing (shipped):** the editor's text mutations now build a `BlockPath`
+   from the cursor and call the `*_at` primitives — identical for a top-level
+   cursor, reaching the right container when nested. `resolve_format_range`
+   returns a `BlockPath`; the formatting toggles, hyperlink, image-insert
+   (new `insert_inline_image_at`, with the flat version delegating to it),
+   typing (`insert_text_at`), and within-paragraph delete (`delete_text_at`)
+   all route through it. Tests (`editor_insert_tests`): a nested cursor links
+   and inserts an image *into a table cell*. Top-level editing unchanged.
+   - ✅ **Path-aware split/merge (shipped):** `split_block_at` / `merge_block_at`
+     resolve the *leaf step's* block list (a cell's or note body's movable list)
+     via a new `resolve_block_list` seam and split/merge **within that
+     container** — top-level `split_block`/`merge_block` now delegate to the same
+     `*_in_list` cores (31 existing top-level tests unchanged). Enter and
+     backspace-at-start route through the `*_at` variants for any cursor; the
+     caret moves to the sibling block via `DocumentPosition::sibling_block`
+     (which shifts the leaf `PathStep` block for a nested cursor, the
+     `paragraph_index` for a top-level one). `merge_block_at` returns
+     `NoPreviousBlock` at the first block of a container, so backspace there is a
+     no-op (no container boundary is ever crossed). Tests
+     (`loro_mutation_nested_tests`): split/merge inside a cell and a note body
+     round-trip; merge at a cell's first block errors.
+5. **Caret rendering** refinements for nested paragraphs.
+   - ✅ **V-align caret-y (shipped):** a vertically-aligned (`Middle`/`Bottom`)
+     cell translates its glyph items down by the alignment offset, but the
+     editing-paragraph origins were left at the cell top, so the caret floated
+     above the text. The non-rotated cell path now translates
+     `current_paragraphs[cell_para_start..]` by the same `y_offset` as the
+     items (`cell_para_start` captured before the cell's blocks flow), so the
+     caret tracks the glyphs. Test (`table_cell_editing_tests`): the cell-0
+     editing origin.y for `Bottom > Middle > Top` (all equal before the fix).
+   - **Rotated-cell editing (deferred):** rotated cells lay content out in a
+     width/height-swapped space wrapped in a `RotatedGroup`, and `flow_cell_blocks`
+     discards its editing paragraphs. Emitting usable editing data needs the caret
+     and hit-test to apply the same rotation transform — a dedicated task
+     (`TODO(rotated-cell-editing)` in `flow.rs`). Rotated cells stay read-only
+     for now (graceful: no caret rather than a wrong one).
+
+   - ✅ **Table / Footnote Insert controls (shipped):** the Insert tab now has
+     **Table** and **Footnote** buttons.
+     - *Primitives (`loki-doc-model`):* `insert_block_after(loro, block_index,
+       &Block)` writes a new block after the cursor's root block using the
+       bridge's own schema (exposed as `pub(crate) loro_bridge::map_block`), so a
+       `Block::Table` round-trips and its cells are live editable containers.
+       `insert_inline_note_at(loro, path, byte_offset, kind, &body)` anchors a
+       footnote at the cursor with a live body container (delegating the
+       `KEY_NOTES`/`MARK_NOTE` schema to the bridge's new
+       `inline_objects::insert_note_at`). `Table::grid(rows, cols)` builds a
+       grid of empty-paragraph cells. Inline-object inserts moved to a new
+       `loro_mutation::objects` module (image + note) to keep `nested.rs` under
+       the ceiling. Tests: `loro_mutation_insert_tests` (table/footnote
+       round-trip, cells/body editable, footnote inside a cell).
+     - *UI (`loki-text`):* `insert_table_after_cursor` / `insert_footnote_at_cursor`
+       in `editor_insert`; ribbon buttons (`LUCIDE_TABLE` / `LUCIDE_FOOTNOTE`,
+       new in `appthere-ui`) routed through a shared `run_insert` helper that
+       relays out, syncs undo/redo, and reports via the status banner. A default
+       2×2 table is inserted after the cursor; a footnote with an empty body at
+       the cursor. *(Cursor stays put after insert — repositioning into the new
+       cell/note needs a relayout-then-locate step with a fresh `page_index`,
+       deferred; the user clicks in to edit, which hit-tests correctly.)*
+
+   **Item 5 is complete.** Spec 04 M4 (the Insert tab) ships Image, Table,
+   Footnote, and Link controls over live, editable nested containers.
+
+Increment 1 shipped: `PageParagraphData.path` + the `push_editing_para` helper
+(which also DRY-collapsed the six placement sites, keeping `flow_para.rs` under
+its baselined ceiling). Increment 2 shipped: the `DocumentPosition`/`CursorState`
+position seam (above). Both keep top-level editing unchanged; the **next
+keystone is increment 3 — layout emission** for table-cell and note-body
+paragraphs (the substantive `flow.rs`/`flow_table` work).
+
+---
+
+## 6. Blitz layout surface for the collapse engine (Spec 04 §4.3)
+
+| Need | Finding |
+|---|---|
+| **Measure the ribbon's own width** | ✅ `onmounted` → `MountedData::get_client_rect().await` works on any mounted element (the dioxus-native patch, `patches/dioxus-native-dom/src/mounted.rs`). The collapse engine measures the content row directly, or uses `use_viewport().inner_width_px` as a proxy. |
+| **Width-driven (px, not class)** | ✅ `use_viewport()` exposes `inner_width_px: f32` (D3 needs px; `use_breakpoint()`'s class alone is insufficient). |
+| **Overflow "more" menu** | ✅ `position: absolute` in a `position: relative` ancestor + `z-index` (the spell panel `editor_spell_panel.rs` is the production precedent). **No** `position: fixed` (collapses to absolute), **no** `box-shadow`, **no** custom properties — elevation via border/background. |
+| **Hysteresis** | ✅ mirror `responsive::page_fit::resolve_page_fit` (`PAGE_FIT_HYSTERESIS_PX = 48`): keep the current collapse state until width crosses `threshold ± band`, so resizing across a boundary can't thrash. A `RIBBON_COLLAPSE_HYSTERESIS_PX` token follows the same shape. |
+
+---
+
+## 7. Corrections & confirmations vs. the spec's seeds
+
+- **Footnotes** seeded "renders to an extent" → audit finds **complete render** → **Create-ready** (not render-only). (RB-7)
+- **Math** "renders; create likely needs a surface" → **confirmed Render-only**; the create gap is real. (RB-8)
+- **Shapes** "render status unknown" → **confirmed Unsupported** (zero shape-geometry render code). (RB-9)
+- **"Existing bottom-ribbon-for-touch placement"** → **does not exist**; only safe-area-inset (`app.rs`) + Compact-detection infrastructure. M6 says "where applicable", so it's an optional build, and the collapse cascade may make it unnecessary on phones. (RB-11)
+- **Framework** "half-built" → contextual + labeled-group + labeled-button capabilities **already exist**; the missing piece is specifically the **collapse cascade** and a **selection signal** for contextual tabs. (RB-1/RB-2/RB-5)
+
+---
+
+## 8. Milestone readiness
+
+| Milestone | Prereqs present? | First step / blocker |
+|---|---|---|
+| **M1 — Framework + rename** | ✅ **Implemented** | `ribbon-tab-home`→`ribbon-tab-write` ("Write"); `home_tab_content`→`write_tab_content`; the Home *screen* key is untouched (collision resolved, RB-6). The framework (tab strip, labeled-group container, contextual mechanism, scroll overflow) already renders sanely at Expanded-by-default. |
+| **M2 — Labeled groups everywhere** | ✅ **Implemented** | All five Write-tab groups now pass `label: Some(fl!("ribbon-group-…"))` (Document/History/Styles/Paragraph/Inline) — the icon-only `label: None` style is retired; the Write tab now matches Publish's labeled-section standard. Compact toggles (B/I/U) keep icon buttons under labeled sections (the Word convention). |
+| **M3 — Collapse cascade** | ⚠️ needs new engine | Build the width-driven engine: per-group priority + condensed/overflow reps + overflow menu (`position: absolute`) + hysteresis (mirror `page_fit`). **The substantive build.** R-13e select-width handled in *condensed*. |
+| **M4 — Render-gate + Insert tab** | ✅ capability table (§4) + create paths (§5) | Add the **Insert** tab with controls for the 5 Create-ready objects only; commit the §4 table. No math/shape controls. |
+| **M5 — Remaining tabs + contextual** | ⚠️ needs selection signal (RB-5) | Add Layout/References/Review from existing features; add a `selected_object: Signal<Option<…>>` in `EditorState`, set it from pointer hit-tests, drive Table/Picture contextual tabs via `is_contextual`. |
+| **M6 — Touch posture** | ✅ `TOUCH_MIN`, breakpoint | Bump tab strip to `TOUCH_MIN` at Compact (R-14); condensed select sizing (R-13e); bottom-ribbon placement *optional* (RB-11). |
+
+---
+
+## 9. Finding register
+
+| ID | Severity | Finding | Anchor |
+|---|---|---|---|
+| RB-1 | Info | Framework already supports contextual tabs + labeled groups/buttons — D1/D2/contextual are mostly *content* work | §2, §7 |
+| RB-2 | High | No width-driven collapse cascade (only a collapse toggle + `overflow-x: auto`) — the M3 build | §2 |
+| RB-3 | Info | R-13e confirmed: `AtRibbonSelect` hardcodes `width: 180px` (`select.rs:73`) — condensed state must size it | §2 |
+| RB-4 | Info | R-14 confirmed: tab strip `36px` (`RIBBON_TAB_STRIP_HEIGHT`) < 44 px touch min | §2 |
+| RB-5 | Med | No selection-state signal exists; contextual Table/Picture tabs need a new `EditorState` signal fed by hit-tests | §2, §8 |
+| RB-6 | ~~Info~~ **Resolved (M1)** | Two-Homes collision fixed: ribbon tab renamed `ribbon-tab-write = Write`; the `Home()` screen keeps its name. | §3 |
+| RB-7 | Info | **Footnotes upgraded** to Create-ready (complete render, simple create) — not render-only | §4 |
+| RB-8 | Info | Math is **Render-only** (renders partial; no create path) — equation editor = future spec | §4 |
+| RB-9 | Info | Shapes are **Unsupported** (no shape-geometry render) — future renderer spec | §4 |
+| RB-10 | Info | Blitz surface sufficient: self-width via `get_client_rect`, px via `use_viewport`, overflow via `position: absolute`, hysteresis via `page_fit` pattern | §6 |
+| RB-11 | Info | **Spec correction:** "existing bottom-ribbon-for-touch placement" does not exist (only infrastructure); M6 optional | §7 |
+| RB-12 | Info | Publish tab is the visual-standard *source*; audit confirms it stays its own tab (export is a distinct concern) | §3 |
+
+---
+
+## 10. Open questions for maintainer triage
+
+1. **Sequencing.** M1/M2/M4 are low-risk content; M3 (collapse engine) is the real build and M5 needs a new selection signal. Land M1+M2 (rename + labeled standard) first, then M4 (Insert from the table), then M3 (collapse), then M5/M6 — or build the framework collapse engine before the content?
+2. **Write tab group set.** Confirm the §9 Write grouping (Clipboard / Font / Paragraph / Styles / Editing) — the inventory has no Clipboard (cut/copy/paste) or Find/Replace controls yet. Map only existing controls (per "don't invent"), or is adding cut/copy/paste + find/replace in scope here?
+3. **Header/Footer create surface (M4).** The 4 other Create-ready objects are cheap; headers/footers need a small block-editor surface. In scope for M4, or defer the header/footer Insert control while shipping the other four?
+4. **Math & shapes.** Confirm math (Render-only) and shapes (Unsupported) get **no** Insert control and become their own future specs (equation editor; shape renderer) — as the capability table dictates.
+5. **Collapse hysteresis + priority.** Reuse `PAGE_FIT_HYSTERESIS_PX = 48` (or a dedicated `RIBBON_COLLAPSE_HYSTERESIS_PX`)? And where do per-group collapse priorities get declared — on `AtRibbonGroup` as a new prop?
+6. **Bottom-ribbon-for-touch (RB-11).** Build it now (it doesn't exist), or rely on the collapse cascade at Compact and defer bottom placement?
+
+No code has been changed. Awaiting triage before implementing M1.
diff --git a/docs/adr/spec-04-ribbon-ui-refinement.md b/docs/adr/spec-04-ribbon-ui-refinement.md
new file mode 100644
index 00000000..f7afbc67
--- /dev/null
+++ b/docs/adr/spec-04-ribbon-ui-refinement.md
@@ -0,0 +1,217 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 04 — Ribbon UI Refinement
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation |
+| **Scope** | AppThere Loki (Text); the ribbon framework is designed as shared monorepo UI infrastructure |
+| **Sequence** | 4 of 6 — consumes the Spec 03 breakpoint system |
+| **Depends on** | Spec 03 (breakpoint context, the Expanded-by-default contract, the R-13e/R-14 inputs); Spec 01 (ADR 0009 layering, design-token location) |
+| **Feeds** | Styling Panel (Spec 05 — the Write tab's Styles group is the entry point into the styling panel) |
+
+---
+
+## 1. Context & Motivation
+
+The ribbon is half-built and internally inconsistent. The current first tab ("Home") looks like a plain icon-button toolbar; the Publish tab uses **labeled controls grouped into labeled sections** — the look the whole ribbon should have. On top of the visual split, there are three structural problems:
+
+1. **A naming collision.** There is a "Home" tab *in the ribbon* and a "Home" screen *for the application* (document/file management). Two different things share a name.
+2. **No deliberate responsiveness.** The ribbon currently just scrolls horizontally when it overflows. That's an acceptable floor but not a design — it should adapt before it resorts to scrolling.
+3. **Missing tabs and a creation gap.** There's no Insert tab, and the editor can *render* objects (images, tables, math, headers/footers, hyperlinks, partially footnotes) it gives the user no way to *create*.
+
+This spec makes the ribbon consistent, responsive, and complete:
+
+- Rename the ribbon's first tab **Home → Write**, resolving the collision.
+- Standardize every tab on the **labeled-group** style (Publish's look), retiring the icon-only style.
+- Build a **progressive collapse cascade** (full groups → condensed → overflow menu) with horizontal scroll kept only as the guaranteed last-resort fallback.
+- Define the full tab set — **Write, Insert, Layout, References, Review** plus contextual **Table** and **Picture** tabs.
+- Gate the **Insert** tab behind a **render-capability audit**: expose creation UI *only* for objects the renderer verifiably handles, so no button creates something the app can't draw and no button does nothing.
+
+The ribbon framework (tab strip, group container, collapse engine, overflow, contextual-tab mechanism) is **shared monorepo UI infrastructure** — Presentation and Spreadsheet have ribbons too. This spec builds the framework in the shared layer and Loki Text's specific tab *content* on top of it.
+
+This is **audit-first**: inventory the existing tabs/groups/controls, run the render-capability audit, and confirm Blitz's layout surface before building. References below are illustrative.
+
+---
+
+## 2. Relationship to Spec 03 (read this first)
+
+Spec 03 shipped the breakpoint system this spec consumes. Two facts from that implementation are now contracts:
+
+- **`use_breakpoint()` is resilient and defaults to `Breakpoint::Expanded`** when no responsive context is present (via `try_consume_context`). The ribbon is persistent chrome, so in Loki Text it *will* have the context — but the shared framework must behave correctly at Expanded-by-default so Presentation/Spreadsheet (which don't yet wire the context) get a sane full-chrome ribbon rather than a broken one.
+- **Tiers are Compact < 600, Medium 600–1024, Expanded ≥ 1024.** The collapse cascade (§7) keys off these *as defaults* but is ultimately **width-driven** (see D3) — it does not assume a tier has room, it measures.
+
+Two Spec 03 findings were explicitly handed forward and are **named inputs** here, not new discoveries:
+
+- **R-13e — ribbon select width.** The ribbon's select/dropdown controls (font family, size) misbehave on width; the condensed state must handle their sizing (§9).
+- **R-14 — tab-strip touch height.** The tab strip needs touch-sized targets at touch-first breakpoints (§9).
+
+Layering and the dependency-direction invariant come from **ADR 0009**. Design tokens are consumed from their post-Spec-01 location (the relocated `loki-renderer → appthere_ui` token edge). The ribbon observes editor **selection state** to drive contextual tabs — a downhill UI→model dependency, permitted by ADR 0009.
+
+Standing Blitz constraints still bind every layout choice: **no `position: fixed`, no `box-shadow`, no CSS custom properties.**
+
+---
+
+## 3. Goals / Non-Goals
+
+**Goals**
+
+- A shared ribbon framework: tab strip, labeled-group container, width-driven collapse engine, overflow menu, contextual-tab mechanism.
+- One consistent visual standard — labeled groups everywhere.
+- Home→Write rename with the application Home screen left distinct.
+- The full tab set with logical, audited control organization.
+- An Insert tab whose every control is backed by a verified render *and* create capability; a committed capability table classifying every object.
+- Touch-appropriate posture at Compact (R-14, R-13e).
+
+**Non-Goals**
+
+- New rendering capability. This spec exposes creation UI for what the renderer *already* handles; it does **not** add renderer support for new object types. (If an object is render-only, it stays creation-less here.)
+- The styling panel itself (→ Spec 05). The Write tab's Styles group is only the *entry point*.
+- Building a math equation editor, a shape-drawing surface, or any large new creation surface — those are flagged by the gate as their own future specs if the audit finds them render-only.
+- The substitution/conformance work (→ Spec 02), though the render-capability gate *should* lean on Spec 02 goldens as evidence where they exist.
+
+---
+
+## 4. Working Method
+
+1. **Inventory the ribbon.** Enumerate current tabs, groups, and controls; note which use the icon-only style vs. labeled groups; locate `AtRibbon` and the tab content.
+2. **Run the render-capability audit (§10).** For each insertable object, determine import/render/create status empirically — leaning on Spec 02 goldens as render evidence where they exist. Produce the capability table.
+3. **Confirm the Blitz layout surface** for the collapse engine (how width is measured, what overflow mechanisms are reliable).
+4. **Build the framework**, then Loki Text's tab content, then the collapse cascade, then contextual tabs.
+5. **Apply touch posture** (R-14, R-13e) at Compact.
+
+---
+
+## 5. Naming
+
+**Decision (D1): the ribbon's first tab is renamed Home → Write; the application Home screen keeps its name.** "Write" is chosen to hold the most-used writing controls (D5). This resolves the two-Homes collision: *Home* now unambiguously means the document-management screen, *Write* is the primary ribbon tab. Both are user-facing strings, localized via `fl!()`.
+
+---
+
+## 6. The Ribbon Framework (shared infrastructure)
+
+Built in the shared UI layer (with `AtRibbon`), consumed by all three apps. Provides:
+
+- **Tab strip** — the row of tab labels, touch-sizable (R-14), with the contextual-tab slots.
+- **Group container** — a labeled section holding controls, with declared collapse behavior (§7).
+- **Collapse engine** — measures available width and collapses groups by priority (§7).
+- **Overflow menu** — a "more" affordance holding groups that don't fit.
+- **Contextual-tab mechanism** — shows/hides a tab in response to a selection signal.
+
+Each app supplies its own tab/group/control *content*; the framework carries no Text-specific assumptions. This mirrors the shared-infra-plus-consumer pattern of Specs 02 and 03.
+
+---
+
+## 7. Progressive Collapse Cascade
+
+**Decision (D3): collapse is width-driven, not tier-driven.** The breakpoint sets defaults, but the engine measures actual available width and collapses groups by declared priority until they fit. This directly answers the open question of whether Expanded (≥1024) "has room" for full labeled groups: it doesn't assume — it tries full, and condenses if it doesn't fit. The cascade, per group, in order:
+
+1. **Full** — labeled group, full-size controls, group label visible.
+2. **Condensed** — controls pack tighter; the group label may drop; low-priority controls within the group may merge into a dropdown. (R-13e's select-width handling lives here.)
+3. **Overflow** — the whole group moves into the overflow ("more") menu.
+4. **Scroll fallback** — only when even overflow can't fit does the strip fall back to horizontal scroll (today's behavior, retained as the guaranteed floor, never the first resort).
+
+Each group declares a **collapse priority** (which groups condense/overflow first) and a defined condensed and overflow representation, so collapse is deterministic and not layout-engine-incidental. Collapse must be hysteretic at the boundaries to avoid thrash when a window is resized across a fit threshold (same principle as Spec 03's renderer switch).
+
+---
+
+## 8. Visual Standard
+
+**Decision (D2): labeled groups everywhere; retire the icon-only style.** The Publish tab's labeled-group look becomes the single standard; the icon-only Home/Write style is removed. Consistency across tabs is the goal, so a control looks and behaves the same wherever it appears. Within the Blitz constraints, group separation and elevation come from borders/background from the token set (no `box-shadow`), and nothing is pinned (`no position: fixed`).
+
+---
+
+## 9. Tab Inventory & Organization
+
+Proposed organization, to be confirmed and mapped against the §4 inventory (the agent maps existing controls to groups; it does not invent controls):
+
+- **Write** (was Home) — the daily driver: Clipboard, Font, Paragraph, Styles (the Spec 05 entry point), Editing (find/replace). The most-used writing controls.
+- **Insert** — objects, **each gated by §10**: images, tables, math, header/footer, hyperlink, footnote (gated), shape (gated). See §10.
+- **Layout** — page setup (size, orientation, margins), columns, spacing, breaks.
+- **References** — footnotes/endnotes management, table of contents, captions, citations. (Footnote *creation* conventionally lives here; it remains gated by §10's render-capability finding.)
+- **Review** — spelling/grammar, word count, language, comments, track changes (if supported), accessibility.
+- **Contextual Table** — appears on table selection: row/column insert-delete, merge, borders, table styles.
+- **Contextual Picture** — appears on image selection: size, wrap, alt text, position.
+
+**Publish reconciliation:** the existing Publish tab (export — PDF/X, EPUB, etc.) is the *source* of the target visual standard and isn't in the writing-tab set above. It should be **retained as its own tab**; export is a distinct concern and folding it into the others would crowd them. The audit confirms nothing in Publish belongs better elsewhere.
+
+**Touch posture (R-14, R-13e):** at Compact / touch-first breakpoints, the tab strip and controls take touch-sized targets (≈44px, consistent with Spec 03's `TOUCH_MIN`), and the ribbon may adopt the existing **bottom-ribbon-for-touch** placement so controls are thumb-reachable. R-13e's select-width handling applies in the condensed state. The essential-controls subset shown at Compact follows from group collapse priority (§7), not a separate hand-maintained list.
+
+---
+
+## 10. The Insert Tab & Render-Capability Gate
+
+The Insert tab's defining rule: **a creation control may exist only if the renderer verifiably handles the object it creates.** This prevents two failure modes — a button that creates something the app can't draw, and a dead button that does nothing.
+
+### 10.1 The audit
+
+For each insertable object, determine three things empirically (leaning on Spec 02 goldens as render evidence where available):
+
+- **Import** — does the importer parse it into the model?
+- **Render** — does the renderer draw it correctly?
+- **Create** — is there a model-construction path to make a new one?
+
+### 10.2 The classification
+
+Each object lands in exactly one bucket:
+
+| Bucket | Condition | Insert-tab treatment |
+|--------|-----------|----------------------|
+| **Create-ready** | renders + has (or can cheaply get) a create path | Full creation control exposed |
+| **Render-only** | renders (imported docs display it) but no/incomplete create path | **No creation control** — no dead UI; tracked as creation-pending |
+| **Unsupported** | renderer can't draw it | Out of scope; tracked |
+
+Render-only objects get **no control at all** rather than a disabled one — a disabled button is still clutter and still implies a promise. Imported documents containing them still display correctly; we simply don't offer to author them yet.
+
+### 10.3 Expected inputs (to be resolved by the audit, not pre-decided)
+
+From the maintainer's current knowledge, seeding the audit (the audit confirms or corrects each):
+
+- **Images, tables, headers/footers, hyperlinks** — render confirmed; expected **create-ready** (images need the existing `loki-file-access` picker).
+- **Math** — renders; **create** likely needs an equation-input surface. If the audit finds no cheap create path, math is **render-only** and an equation editor becomes its own future spec.
+- **Footnotes** — renders "to an extent"; the audit determines whether it's create-ready or render-only based on how complete the render path is.
+- **Shapes** — render status **unknown**; if the renderer can't draw shapes, **unsupported** (no creation control), and shape support becomes a future renderer spec before any Insert control appears.
+
+The capability table is a committed deliverable, so the Insert tab's contents are *derived from verified capability*, not from a wishlist.
+
+---
+
+## 11. Key Decisions (ADR-style)
+
+**D1 — Home→Write; app Home screen unchanged.** Resolves the two-Homes collision with the writing-focused name. Tradeoff: users used to "Home" relearn one label — minor, and the collision was worse.
+
+**D2 — Labeled groups everywhere.** One consistent standard (Publish's), icon-only retired. Tradeoff: icon-only is denser — but consistency and labels' discoverability win, and the collapse cascade recovers density when space is tight.
+
+**D3 — Collapse is width-driven, not tier-driven.** The engine measures and condenses by priority; the breakpoint only sets defaults. Tradeoff: a measuring collapse engine is more work than CSS breakpoints — required, because the ribbon can overflow even at Expanded.
+
+**D4 — Insert controls are gated by verified render+create capability; render-only gets no control.** No button draws the undrawable; no dead buttons. Tradeoff: some objects users might want to insert (math, maybe shapes) may be absent at first — honest, and each becomes a tracked future spec rather than a broken control.
+
+**D5 — Write holds the most-used controls.** The first tab is the daily driver. Tradeoff: deciding "most-used" is a judgment — grounded in the §4 inventory and convention, confirmable later.
+
+---
+
+## 12. Milestones & Acceptance Criteria
+
+**M1 — Framework + rename.** Shared tab strip, labeled-group container, overflow scaffold, contextual-tab mechanism; Home→Write; `fl!()` strings. *Accept:* the framework renders a sane full-chrome ribbon at Expanded-by-default with no responsive context (Presentation/Spreadsheet path); the two-Homes collision is gone.
+
+**M2 — Visual standardization.** Every tab on the labeled-group standard; icon-only style removed. *Accept:* no tab uses the retired style; controls look/behave identically across tabs within Blitz constraints.
+
+**M3 — Collapse cascade.** Width-driven full→condensed→overflow→scroll with per-group priority and hysteresis; R-13e select-width handled in condensed. *Accept:* narrowing the window condenses then overflows groups by priority before any horizontal scroll appears; resizing across a threshold doesn't thrash.
+
+**M4 — Render-capability gate + Insert tab.** Committed capability table; Insert tab exposes only create-ready controls; render-only objects have no control. *Accept:* every Insert control maps to a create-ready row in the table; no control exists for a render-only/unsupported object; imported docs with render-only objects still display.
+
+**M5 — Remaining tabs + contextual.** Layout, References, Review populated from the inventory; Table/Picture appear on selection and dismiss on deselection. *Accept:* selecting a table shows the Table tab and hides it on deselection; same for Picture; no tab invents controls absent from the inventory.
+
+**M6 — Touch posture.** Tab strip and controls touch-sized at Compact (R-14); bottom-ribbon-for-touch placement where applicable; Compact control set follows collapse priority. *Accept:* at Compact, targets meet `TOUCH_MIN`; the Compact ribbon is usable by thumb without horizontal scrolling for the essential set.
+
+---
+
+## 13. Out of Scope
+
+- Adding renderer support for any object (this spec only exposes creation for what already renders).
+- Building an equation editor, shape-drawing surface, or other large creation surface flagged render-only by the gate — each becomes its own future spec.
+- The styling panel internals (→ Spec 05); the Write Styles group is only the entry point.
+- Conformance/substitution work (→ Spec 02), though the gate uses its goldens as render evidence.
+- Benchmarking the ribbon's layout cost (→ Spec 06).
diff --git a/docs/adr/spec-05-style-audit.md b/docs/adr/spec-05-style-audit.md
new file mode 100644
index 00000000..91bc9319
--- /dev/null
+++ b/docs/adr/spec-05-style-audit.md
@@ -0,0 +1,315 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 05 — Style Management Panel: Audit Report
+
+| | |
+|---|---|
+| **Status** | Audit complete; **no code changes**. Triaged build order below — M1 (provenance resolution) is the keystone everything reads. |
+| **Method** | Audit-first per Spec 05 §4: inventory the current panel, the style model + resolution logic, and the six-family modelling completeness before building. |
+| **Companion** | [spec-05-style-management-panel.md](spec-05-style-management-panel.md) (the design spec) |
+| **Precedent** | Same audit-then-triage flow as [spec-01](spec-01-audit-report.md) / [spec-03](spec-03-responsive-audit.md) / [spec-04](spec-04-ribbon-audit.md). |
+
+This report establishes ground truth and a finding register (**SM-1 … SM-14**). It
+makes **no code changes** — implementation waits for triage. The headline
+deliverables are the **resolution-gap analysis** (§3), the **six-family
+completeness table** (§5), and **one spec-premise correction** (SM-11).
+
+---
+
+## 1. Executive summary
+
+- **The resolution layer is half-built — and the panel ignores the half that exists.** `StyleCatalog::resolve_para` already walks the parent chain and merges properties, cycle-guarded by `MAX_STYLE_CHAIN_DEPTH = 32` (SM-1). But it returns **bare values with no provenance**, and the current panel doesn't even call it — `style_to_draft` reads only the style's *own local* fields (`unwrap_or_default`), which is exactly the "local-only blindness" the spec names (SM-3). So Spec 05's headline (D2, provenance inspector) is a **new provenance-aware resolution layer** (M1), not a from-scratch walk.
+- **`resolve_char` is misnamed and there is no character-style resolver.** It resolves `ParagraphStyle.char_props`, not a standalone `CharacterStyle`'s parent chain (SM-2). The character family (a v1 "build-first" family) has **no working resolution today**.
+- **The conditional-panel pattern (D1) is already proven viable — low-risk.** `FontWarning` is a `#[component]` that calls the resilient `use_breakpoint()` (defaults to `Expanded`) successfully; the current style/metadata/language panels are plain fns called inside `if` with early returns and so *can't* (SM-5, SM-6). Converting panels to components is mechanical, and `editor_inner.rs` is **849 lines vs its 878 baseline** — D1 specifically avoids the flag-threading that would grow it.
+- **The six families are unevenly modelled (SM-9).** Paragraph & character: complete. List/numbering: complete per-level but **no inheritance between list styles** (so the tree view §7 is N/A for lists). **Table: no conditional regions** (header/banding/first-last) — model extension required. **Page: not in the catalog at all** — page setup is per-section `PageLayout`; the §5 OOXML/ODF asymmetry is real and M1 must decide it. Linked: a **one-way** `linked_char_style` field, no reciprocal, no dedicated surface.
+- **Spec-premise correction (SM-11):** the spec (§6, §8) repeatedly assumes "existing `COMPAT(i18n)` annotations on internal match keys like 'Default Paragraph Style'." **These annotations do not exist.** `"Default Paragraph Style"` is an *unannotated hardcoded magic string* in `loro_mutation/style.rs`. Built-in-style identification must be defined (likely via the existing `is_default` flag + a known-id set), and the magic string reconciled with the no-hardcoded-strings convention.
+- **Staged-Apply and the CRDT snapshot are a good fit (SM-7, SM-8).** Edits stage in a `StyleDraft` and commit on Apply via `write_document_styles` → `loro.commit()` (undoable). The whole catalog is one JSON snapshot, so impact-preview/propagation (§7) is an **in-memory computation over the catalog tree**, and Apply is one atomic, undoable write — matches D4/D5 cleanly.
+
+**Readiness verdict:** the model is a **solid foundation with four concrete gaps** that gate the inspector — (a) provenance, (b) a real character-style resolver, (c) table conditional regions, (d) page styling representation — plus the built-in-style/`COMPAT(i18n)` reconciliation. None are blockers; all are well-scoped model work that must land **before** the family panels that depend on them.
+
+---
+
+## 2. Finding register
+
+| ID | Finding | Evidence |
+|---|---|---|
+| **SM-1** | `resolve_para` walks the parent chain and merges (`merged_with_parent`, child-wins), cycle-guarded by `MAX_STYLE_CHAIN_DEPTH = 32` — but returns a bare `ResolvedParaProps = ParaProps` with **no provenance**. | `loki-doc-model/src/style/catalog.rs:134-146`, `:22-28`, `:58-65`; `style/props/para_props.rs:213-255` |
+| **SM-2** | `resolve_char` resolves `ParagraphStyle.char_props`, **not** a standalone `CharacterStyle`. No `resolve_char_style` exists; the character family has no working parent-chain resolution. | `loki-doc-model/src/style/catalog.rs:157-169` |
+| **SM-3** | The panel reads only the style's **own local** fields via `style_to_draft` (`unwrap_or_default`), never calling the existing `resolve_*`. This *is* the "local-only blindness." | `loki-text/.../editor_style_editor/draft.rs:27-77`, esp. `:50-52` |
+| **SM-4** | The panel is **paragraph-only**; character/list/table styles are modelled but not editable, and there is no family picker. | `editor_style_editor/mod.rs`, `draft.rs:27` (`style_to_draft(&ParagraphStyle)`) |
+| **SM-5** | Style panel mounts as a **plain fn inside `if`** with an early `return rsx!{}`; same for metadata (R-13g) and language panels. None read `use_breakpoint`; no `compact` flag is threaded. | `editor_inner.rs:689-702`, `editor_style_editor/mod.rs:59-62`; `editor_metadata_panel.rs:40,46-49` |
+| **SM-6** | D1 is proven viable: `FontWarning` is a `#[component]` calling `use_breakpoint()`; the hook is resilient (`try_consume_context` → `Expanded`). | `editor_font_warning.rs:200-207`; `appthere-ui/src/responsive/mod.rs:93-98` |
+| **SM-7** | Staged-Apply confirmed: `StyleDraft` buffer → Apply → `commit_style_to_loro` → `write_document_styles` → `loro.commit()` (undoable). Matches §12 — keep it. | `editor_style_editor/form.rs:213-240`; `editor_style_catalog.rs:20-35` |
+| **SM-8** | The whole `StyleCatalog` round-trips as **one JSON snapshot** under `KEY_STYLE_CATALOG_JSON` — atomic, lossless, undoable. Propagation/impact-preview is therefore an in-memory catalog computation. | `loki-doc-model/src/loro_bridge/styles.rs:4-16,24-66` |
+| **SM-9** | Six-family modelling is uneven (full table in §5): paragraph/character complete; list complete-but-non-inheriting; **table lacks conditional regions**; **page absent from catalog**; linked one-way. | per §5 table |
+| **SM-10** | Defaults: only `default_paragraph_style: Option<StyleId>` + `effective_paragraph_style` fallback. **No** char/table/list/page family defaults and **no** format-default representation. | `catalog.rs:92-102,118-123` |
+| **SM-11** | **Spec-premise correction:** no `COMPAT(i18n)` annotations exist anywhere. `"Default Paragraph Style"` is an unannotated hardcoded magic string. `is_default: bool` exists on `ParagraphStyle` and is the real built-in marker. | grep (zero `COMPAT(i18n)`); `loro_mutation/style.rs:20,43,62`; `para_style.rs:57-59` |
+| **SM-12** | Re-parenting (M4) needs an explicit **cycle check**: today only the depth cap (32) prevents infinite loops on corrupt input; there is no guard that rejects forming a cycle. | `catalog.rs:22-28` (cap only) |
+| **SM-13** | Compact substrate is present: `TOUCH_MIN = 44.0`, `BREAKPOINT_COMPACT_MAX_PX = 600.0`, `position: absolute`-in-`relative` precedent (spell panel); no `fixed`/`box-shadow`/custom-props. | `tokens/spacing.rs:58`; `tokens/layout.rs:80`; `editor_spell_panel.rs`; `CLAUDE.md:309-322,334-335` |
+| **SM-14** | Decomposition pressure: current panel = 6 files / ~1212 lines; `editor_style.rs` is **baselined at 316** (over ceiling) and `editor_inner.rs` at **878** (file now 849). New panels must be ≤300, component-per-panel; do not grow either baselined file. | `wc -l`; `scripts/file-ceiling-baseline.txt:15,35` |
+
+---
+
+## 3. Resolution model — gap analysis (the M1 keystone)
+
+**What exists.** A single-parent walk + child-wins merge, cycle-bounded:
+
+```
+resolve_para(id):  props = style.para_props
+                   for ≤32 ancestors: props = props.merged_with_parent(ancestor.para_props)
+                   → ResolvedParaProps (= ParaProps)            // catalog.rs:134-146
+```
+
+`merged_with_parent` fills only `None` fields from the parent (child wins), per
+property (`para_props.rs:213-255`, `char_props.rs:216-259`). `ResolvedParaProps`
+/ `ResolvedCharProps` are **bare type aliases** — the result is indistinguishable
+from a hand-set style (`catalog.rs:58-65`).
+
+**What Spec 05 §5 needs (and is missing):**
+
+1. **Provenance.** Every resolved property must carry `(provenance, value)` where
+   provenance ∈ {`Local`, `Inherited from ⟨id⟩`, `Default`, `FormatDefault`}.
+   Today: values only (SM-1). → **New** resolution result type; the existing
+   merge can be instrumented to record *which* ancestor first set each field
+   rather than collapsing them.
+2. **A real character-style resolver.** `resolve_char` is the paragraph's
+   char-props walk, not `CharacterStyle`'s own chain (SM-2). → **New**
+   `resolve_char_style(id)` over `character_styles`.
+3. **Four-level fall-through.** `Default` (family-default style / `docDefaults`)
+   and `FormatDefault` (engine fallback) are not represented (SM-10). → define a
+   per-family default-style reference and a format-default source.
+4. **Cycle-safe re-parenting** (M4): single-parent + an explicit reject-on-cycle
+   check, not just the depth cap (SM-12).
+
+**Page-style asymmetry (Spec 05 §5 — must be decided in M1's ADR).** Page setup
+is **not** a named catalog entry; it lives per-section in `PageLayout`
+(`layout/page.rs:136-173`, `layout/section.rs`), mirroring OOXML `w:sectPr`. ODF
+*does* have named page styles (`style:page-layout` + `style:master-page`). The
+M1 ADR must choose: **(A)** add `page_styles` to `StyleCatalog` (ODF-native named
+page styles, mapped to OOXML sections on export — the spec's lean), or **(B)**
+present each section's `PageLayout` as a synthetic "page style" in the panel
+without a catalog change. Recommendation: **(A)**, because the inspector/tree
+pattern assumes named, inheritable entries — but flag that page styles do **not**
+inherit like the other families (so, like lists, the tree view degrades).
+
+---
+
+## 4. The conditional-panel pattern (Spec 05 §10 / D1) — confirmed ready
+
+The blocker Spec 03 deferred (R-13g) is real and reproduced here (SM-5): a panel
+that is a *plain fn called inside `if`* with `None => return rsx!{}` cannot host
+a hook, so it cannot call `use_breakpoint()`; threading a `compact` flag instead
+pushed `editor_inner.rs` over its ceiling.
+
+The fix is already demonstrated in-tree (SM-6): `FontWarning` is a `#[component]`
+that calls `use_breakpoint().is_compact()` directly, and `use_breakpoint` is
+resilient (`try_consume_context` → `Breakpoint::Expanded`, never panics). So D1 —
+"conditionally-shown panels are components, mounted at the boundary via
+`{open().then(|| rsx!{ Panel { .. } })}`" — is a **mechanical, low-risk
+conversion**, not new infrastructure. `editor_inner.rs` at 849/878 has headroom,
+and D1 keeps it from growing (no flag threading). This pattern should be written
+down as a project convention (M3) and the inspector + first family panel born as
+components.
+
+---
+
+## 5. Six-family modelling completeness
+
+| Family | Struct (evidence) | Property set | Inheritance | Gap vs Spec 05 |
+|---|---|---|---|---|
+| **Paragraph** | `ParagraphStyle` (`para_style.rs:22-67`) | `para_props` (28+) + `char_props` | ✓ single-parent (`parent`) | None — *build first* |
+| **Character** | `CharacterStyle` (`char_style.rs:20-41`) | `char_props` (23+) | ✓ field present | **No resolver** (SM-2) — *build first* |
+| **Linked** | field `linked_char_style` on `ParagraphStyle` (`para_style.rs:37-40`) | — | one-way para→char | No reciprocal, no dedicated surface (§9) |
+| **List / Numbering** | `ListStyle` + `ListLevel` (`list_style.rs:137-172`) | per-level (≤9): kind, indents, label align, char_props | **none** (lists independent) | Tree view N/A; inspector applies *per level* |
+| **Table** | `TableStyle` / `TableProps` (`table_style.rs:49-92`) | width, align, padding, spacing, border, bg | ✓ `parent` | **No conditional regions** (header/banding/first-last) — model extension |
+| **Page** | `PageLayout` per-section (`layout/page.rs:136-173`); **not in `StyleCatalog`** (`catalog.rs:79-103`) | geometry, margins, orientation, columns, headers/footers | n/a | **Absent from catalog**; §5 asymmetry decision (M1) |
+
+Implications for the uniform inspector (§6/§9):
+
+- **Lists** reuse the inspector **per level**, but have no parent tree (§7 degrades to a level list, not a hierarchy).
+- **Tables** need `TableProps` extended with conditional-region slots before the table panel's "conditional-format" rows (§9) have anything to bind to.
+- **Page** needs the M1 representation decision before its panel exists; expect ODF-native named page styles mapped to OOXML sections on export.
+- **Linked** is a *relationship*, not inheritance: the panel surfaces one editing surface over `ParagraphStyle` + its `linked_char_style`; a reciprocal pointer is optional UI sugar, not required by the model.
+
+---
+
+## 6. Apply model & CRDT (Spec 05 §12) — keep as-is
+
+Staged-Apply is confirmed and adequate (SM-7): inputs mutate an in-memory
+`StyleDraft`; **Apply** converts it to a `ParagraphStyle`, inserts it into a
+cloned catalog, and calls `write_document_styles` → `loro.commit()`, making the
+edit a single undoable transaction. Because the catalog is one JSON snapshot
+(SM-8), **propagation and impact-preview (§7/D4) are pure in-memory computations
+over the resolved tree** — no CRDT-structure work — and Apply remains one atomic
+write. No change to the apply model is warranted; the new work is the **staged
+multi-override** display (pending vs committed) and computing the **dependent set**
+for the impact preview from the catalog.
+
+---
+
+## 7. Compact / decomposition readiness (Spec 05 §11)
+
+The substrate is in place (SM-13): `TOUCH_MIN = 44.0`, `BREAKPOINT_COMPACT_MAX_PX
+= 600.0`, and the `position: absolute`-in-`position: relative` precedent
+(`editor_spell_panel.rs`) for a bottom-sheet that obeys Blitz limits (no `fixed`,
+no `box-shadow`, no custom properties). Decomposition is a hard requirement
+(SM-14): the current panel is already 6 files/~1212 lines with `editor_style.rs`
+**over the ceiling** (baselined 316). Every new surface — inspector framework,
+each family panel, the tree view, the reusable property-row — is its own
+component/file ≤300 lines (which *is* the D1 pattern), and neither `editor_style.rs`
+nor `editor_inner.rs` (baseline 878) may grow.
+
+---
+
+## 8. Triaged build order (maps Spec 05 §4 / M1–M7)
+
+Model gaps gate the UI, so the sequence front-loads model work:
+
+1. **M1 — Provenance resolution layer + page-style ADR.** ✅ **Core shipped.**
+   `style/resolve.rs`: `Provenance` (Local / Inherited(id) / Default /
+   FormatDefault) + generic `Resolved<T>`; getter-based `resolve_para_chain`
+   (serves para props *and* a paragraph style's run-default char props) and
+   `resolve_char_chain` (the standalone `CharacterStyle` resolver SM-2 lacked);
+   cycle/depth-guarded, with `para_ancestors` + `para_reparent_cycles` for the
+   §7 re-parent guard. 13 tests. The page-style asymmetry + provenance model are
+   recorded in [ADR-0012](0012-style-resolution-and-page-styles.md) (page styling
+   = ODF-native named page styles in the catalog, mapped to OOXML sections on
+   export, a **non-inheriting** family). *Remaining M1 follow-ups (sequenced, not
+   blockers): per-family `Default` sources beyond paragraph (char/table defaults),
+   and the `page_styles` catalog field itself (lands with the M6 page panel).*
+   *Foundation — everything reads it.*
+2. **M3 — Conditional-panel pattern.** ✅ **Shipped.** Convention recorded in
+   [ADR-0013](0013-conditional-panels-are-components.md) + a CLAUDE.md note:
+   conditionally-shown panels are `#[component]`s mounted at the boundary
+   (`{open().then(|| rsx!{ … })}`), reading `use_breakpoint()` directly — no
+   `compact` flag threaded, so the parent does not grow. Reusable
+   `appthere_ui::AtPanelHost` realizes it (a component reading the breakpoint;
+   pure unit-tested `PanelPosture::for_breakpoint` → Compact full-width sheet vs
+   Medium/Expanded bounded side panel; close control ≥ `TOUCH_MIN`; token
+   border/background, no `box-shadow`, in-flow, per Blitz limits). Spec 05's
+   family panels (M2/M6) mount their inspector inside it, born responsive.
+   *(R-13g's metadata-panel conversion remains Spec 03's milestone — this only
+   provides the pattern + host it needs.)*
+3. **M2 — Inspector** (paragraph + character) over M1, with provenance rows,
+   reset-to-inherited, edit-creates-override, jump-to-ancestor, staged display,
+   display-name-over-id. 🚧 **Row model shipped** (`style_inspector.rs`):
+   `paragraph_inspector_rows(&catalog, &id)` builds one `InspectorRow` per
+   *applicable* property (font/size/bold/italic + alignment/indents/spacing/
+   line-height), each carrying its resolved `value_display` and a display-ready
+   `RowProvenance` (Local / Inherited{ancestor_id, ancestor_display} / Default /
+   FormatDefault) — every property appears regardless of local-set state (the
+   local-only blindness fix), and inherited rows name the source ancestor by
+   **display name** while keeping its `StyleId` for jump-to-ancestor. Pure +
+   i18n-free; 7 tests. **Read-only inspector view shipped**
+   (`editor_style_editor/provenance.rs`): a `StyleProvenanceList` `#[component]`
+   (ADR-0013) renders every property with its resolved value and a localized
+   provenance line (Local / Inherited · ⟨ancestor⟩ / Default / Auto) as a column
+   in the style editor panel — the local-only blindness is now *visibly* gone;
+   local rows are emphasised. New `style` i18n domain. **Reset-to-inherited
+   shipped**: pure `clear_local_property(&mut style, property)` (10 tests total)
+   + a per-row reset control on locally-set rows that clears the override via the
+   existing `commit_style_to_loro` path (undoable) and re-derives the draft, so
+   the property falls through to its inherited/default/engine value.
+   **Jump-to-ancestor shipped**: an inherited row's provenance chip is a link
+   that opens the source ancestor in the editor (via the `StyleId` the row
+   carries), so a property can be changed at its source for all dependents.
+   **Built-in identification decided (SM-11):** the assumed `COMPAT(i18n)`
+   annotations do not exist and are *dropped*; `ParagraphStyle::is_builtin()`
+   (`is_default || !is_custom`) is the rule M5's delete/rename guards will use.
+   **Staged display shipped (§12):** the inspector previews the *pending* draft
+   (`draft_to_style` over a catalog snapshot) and flags rows that differ from the
+   committed style with a pending marker; an unedited draft round-trips, so
+   markers appear only for actually-changed properties and clear on Apply/reset.
+   **M2 is substantively complete** — provenance view, reset-to-inherited,
+   jump-to-ancestor, staged display, and built-in identification all shipped and
+   tested. *Resolved in M7:* the panel was **not** wrapped in `AtPanelHost` —
+   that host is a narrow (360px) side-panel/sheet, whereas this editor is a wide
+   multi-column surface (list + form + 220px provenance + family inspectors);
+   forcing that posture would break the layout. M7 instead gives the panel its
+   own breakpoint-driven `StylePanelPosture` (a Compact stacked sheet), reusing
+   `PanelPosture`'s tested `for_breakpoint` shape without its container.*
+4. **M5 — Creation & management.** ✅ **Shipped.** *Delete-with-orphan-handling:*
+   `StyleCatalog::delete_paragraph_style` re-parents the deleted style's children
+   to the grandparent (5 tests); `perform_style_delete` guards built-ins
+   (`is_builtin`, M2) and a Delete control (`actions.rs`) reports the re-parented
+   count via the status banner and closes the panel. *Create-from-parent:* "+ New"
+   now defaults the new style's parent to the current committed style, so it opens
+   inheriting everything ready to override (all props empty → shown as inherited).
+   *Rename* (display-name field) and *re-parent* (based-on field + M4 cycle guard)
+   were already present; *built-in rules* enforced via `is_builtin`.
+5. **M4 — Tree view + propagation + impact preview.** ✅ **Shipped.** Model
+   (`style/tree.rs`): `para_children` / `para_descendants` (cycle/depth-guarded)
+   / `para_forest_preorder` (indented render order) / `dependents_affected`
+   (the *exact* set whose value changes — excludes subtrees shadowed by a closer
+   override, covers add-override; 9 tests). UI: the style-editor left column is
+   now an inheritance-tree picker (depth-indented, `catalog_style_tree`); an
+   impact-preview banner names the dependents a staged change will also change
+   (`style_impact::affected_dependents`, 4 tests); and Apply rejects a cyclic
+   re-parent via `para_reparent_cycles` (M1) with a status message.
+6. **M6 — Remaining families.** ✅ **Actionable families shipped** (character,
+   linked, list); table + page deferred model-gated (rationale below). *Character:*
+   `style_char_inspector::character_inspector_rows` resolves a standalone
+   `CharacterStyle`'s own chain via `resolve_char_chain` (M1 / SM-2), emitting the
+   shared `InspectorRow` shape so the provenance view is reused across families
+   (4 tests). *Linked (shipped):* the paragraph inspector now shows the linked
+   character style's rows read-only beneath the paragraph rows (`CharRowsSection`,
+   fed by `panel_data::inspector_data` which reads `linked_char_style`) — the §9
+   "both aspects, one surface". Inspector-data computation was extracted to
+   `panel_data.rs` (mod.rs 257). *Character panel (shipped):* the panel's left
+   column now lists every `CharacterStyle` under a "Character styles" heading
+   (`char_browser::char_list_section`, fed by `panel_data::char_data`); selecting
+   one writes its id into the threaded `editing_char_style` signal and renders that
+   style's own resolved rows read-only in a right-hand `CharRowsSection` — a
+   browse-and-inspect surface reusing the shared provenance renderer. Char-style
+   *editing* (a char-props form) is a later increment (§9 "equal depth not required
+   in v1"). *List panel (shipped):* list styles are **non-inheriting** (ADR-0004:
+   a flat vector of per-level definitions), so `style_list_inspector`
+   `list_inspector_rows` flattens a `ListStyle` into one read-only row per indent
+   level (label kind + geometry + alignment) — no provenance chain (4 tests). The
+   left column lists every list style under a "List styles" heading
+   (`list_browser::list_list_section`, fed by `panel_data::list_data`); selecting
+   one shows its per-level rows in a right-hand column. Both non-paragraph
+   read-only columns now share `family_inspector::family_inspector_columns` (char
+   reuses `CharRowsSection`; list renders per-level), keeping `mod.rs` under the
+   ceiling (280). *Remaining (deferred, with rationale):*
+   **table** — needs `TableProps` conditional regions, which the renderer does not
+   yet honor → the spec's "don't add unrenderable properties" gate; **page** —
+   needs the `page_styles` catalog representation of ADR-0012. Both are model-gated
+   and out of scope for this UI pass; the family-panel scaffold (list + inspector
+   columns) is in place to host them once the model lands.
+7. **M7 — Compact posture.** ✅ **Shipped.** A pure, tested
+   `posture::StylePanelPosture::for_breakpoint` (mirrors `appthere_ui::PanelPosture`;
+   2 tests) maps the size class to layout: at Compact (< 600, Spec 03) the body
+   switches from side-by-side columns to a **full-width stacked sheet** (taller
+   height, `flex-direction: column`, vertical scroll — no horizontal overflow),
+   every nav control meets the 44 px `TOUCH_MIN`, and a segmented **Edit / Inspect**
+   switcher (`body::section_switcher`) chooses which stacked group is visible so
+   the tree + families + inspectors are all reachable without horizontal scrolling.
+   At Medium/Expanded the existing side-by-side surface is unchanged. Posture is
+   threaded (the panel is a plain fn that cannot host `use_breakpoint()`, so
+   `editor_inner` — a component — reads the breakpoint and passes it in, plus a
+   `style_panel_inspect` signal for the switcher); every section/inspector consumes
+   it for width + touch. Decomposition held the ceiling: the left column + switcher
+   moved to `body.rs`, posture to `posture.rs` (mod.rs 243). *Deferred with
+   rationale:* the tree's **breadcrumb + drill-down** degrade (§7/§11) — the
+   depth-indented tree remains operable at Compact (indentation is small, no
+   horizontal scroll), so breadcrumb navigation is a refinement, not an
+   accept-blocker; it lands when the tree grows a dedicated component.
+
+**Prerequisite model extensions** (call out so they're not discovered late):
+provenance result type + char-style resolver + per-family defaults (M1);
+`TableProps` conditional regions (before table panel, M6); page-style catalog
+representation (M1 decision, realized before page panel, M6).
+
+---
+
+## 9. What this audit deliberately did **not** do
+
+- No code changes (per Spec 05's audit-first method and the spec-04 precedent).
+- Did not re-verify style round-trip fidelity (→ Spec 02).
+- Did not touch Spec 03's R-13g closure (this audit only confirms the pattern
+  that unblocks it).
+- Did not design property-by-property panel layouts — that is M2/M6 work once the
+  M1 resolution shape is fixed.
diff --git a/docs/adr/spec-05-style-management-panel.md b/docs/adr/spec-05-style-management-panel.md
new file mode 100644
index 00000000..f724c4bb
--- /dev/null
+++ b/docs/adr/spec-05-style-management-panel.md
@@ -0,0 +1,228 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 05 — Style Management Panel
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation |
+| **Scope** | AppThere Loki (Text); the inspector framework is shared UI infrastructure where reusable |
+| **Sequence** | 5 of 6 — depends on a trusted style model, the responsive foundation, and the Write→Styles entry point |
+| **Depends on** | Spec 02 (trusted style round-trip), Spec 03 (breakpoint context — **this spec resolves the deferred conditional-panel context problem**), Spec 04 (Write→Styles entry point), Spec 01 (ADR 0009 layering, token location) |
+| **Feeds** | A future direct-formatting-cleanup tool (out of scope here); Spec 06 measures resolution cost |
+
+---
+
+## 1. Context & Motivation
+
+Loki's philosophy is **named styles over direct formatting** — reusable paragraph, character, and other styles are the intended way to format a document. But the panel that manages them is a rough prototype: mostly unstyled controls in a panel, and — critically — it **only shows properties that are locally set on the style**. Everything a style *inherits* from its parent is invisible. That defeats the entire point of an inheritance-based style system: you can't see where a property actually comes from, so you can't reason about it or change it in the right place.
+
+This spec rebuilds the panel into a real style-management surface that competes with LibreOffice and Word, organized around two ideas:
+
+1. **A resolved-vs-overridden inspector.** For every property of a style, show its resolved value *and its provenance* — is it set locally on this style, inherited from a named ancestor, or a document/format default? One click resets a local override back to inherited.
+2. **An inheritance tree view.** See the whole style hierarchy, understand what depends on what, and change a base style with confidence that the change propagates to its dependents — with an impact preview before you commit.
+
+It covers **all six style families** (paragraph, character, linked, list/numbering, table, page), unified by the same inspector pattern, and it must be usable on a phone.
+
+It also pays down an architectural debt: Spec 03 deferred a fix because **conditionally-rendered panels couldn't read the responsive context**. The styling panel is *entirely* conditionally-mounted family panels, so this spec **owns and defines the sanctioned pattern** for that — once, here, instead of per panel.
+
+This is **audit-first**: inspect the current panel, the style model and its resolution logic, and how completely each of the six families is modeled, before building. References below are illustrative.
+
+---
+
+## 2. Relationship to Prior Specs (read first)
+
+- **Spec 02 — trust.** The inspector is only as correct as the style model underneath it. Spec 02's round-trip axis is what guarantees styles survive import/export without silent loss (cf. the collapsed-style risk it names). This spec assumes that trust; it does not re-verify the model.
+- **Spec 03 — the deferred problem is ours.** `use_breakpoint()` is resilient (defaults to `Breakpoint::Expanded` via `try_consume_context`). Spec 03 deferred R-13g because a panel rendered as a *plain function inside an `if`* with an early return can't host a hook. The styling panel can't dodge this — it's all conditional panels. §10 defines the fix and that fix retroactively unblocks R-13g.
+- **Spec 04 — the entry point.** The Write tab's **Styles group** is how this panel is opened. Style application (clicking a style to apply it) lives in the ribbon/quick-styles; *this* panel is for **defining and managing** styles.
+- **ADR 0009** governs layering; **design tokens** come from their post-Spec-01 location. **Blitz constraints** bind: no `position: fixed`, no `box-shadow`, no CSS custom properties.
+
+---
+
+## 3. Goals / Non-Goals
+
+**Goals**
+
+- A resolved-vs-overridden inspector with per-property provenance and one-click reset-to-inherited.
+- An inheritance tree view with propagation, impact preview, and re-parenting.
+- First-class **style creation** (pick family, pick parent, name, override) and management.
+- Panels for all six families, sharing the inspector framework.
+- A documented, sanctioned **conditional-panel context pattern** (§10).
+- Full Compact/phone usability.
+
+**Non-Goals**
+
+- "Update style to match selection" (Loki discourages direct formatting; the control isn't useful here).
+- The direct-formatting → named-style **cleanup tool** (explicitly deferred to a future spec).
+- Adding style *properties the renderer can't honor* — the panel edits what the model+renderer support, audited like Spec 04's Insert gate.
+- Re-verifying style round-trip (→ Spec 02).
+- Style *application* UX (→ Spec 04's quick-styles); this panel is definition/management.
+
+---
+
+## 4. Working Method
+
+1. **Inventory** the current panel and the style model: how styles, parents, defaults, and the six families are represented; where resolution currently happens (if at all).
+2. **Build the resolution layer** (§5) — provenance-aware style resolution is the foundation everything else reads.
+3. **Build the inspector** (§6), then the tree view (§7), then creation/management (§8).
+4. **Establish the conditional-panel pattern** (§10) before building the family panels, so every family panel is born correct.
+5. **Implement the six family panels** (§9), paragraph+character first (they exercise the full pattern), then the rest.
+6. **Apply Compact posture** (§11) throughout.
+
+Standing standards apply; the panels are substantial, so **decomposition under the 300-line ceiling is a first-class requirement** (§11), not an afterthought.
+
+---
+
+## 5. Inheritance & Resolution Model
+
+The technical core. Style inheritance in both formats is **single-parent** (OOXML `w:basedOn`, ODF `style:parent-style-name`), so the hierarchy per family is a **tree**, not an arbitrary graph — rooted at the family's default style. (Linked styles add a paragraph↔character cross-reference, which is *not* inheritance and is handled separately in §9.)
+
+For a style `S` and property `P`, resolution yields a value **and its provenance**:
+
+1. **Local** — `P` is set on `S` itself → `(Local, value)`.
+2. **Inherited** — walk `S`'s parent chain to the first ancestor `A` that sets `P` → `(Inherited from A, value)`.
+3. **Default** — fall to the family default style / document defaults (`docDefaults` in OOXML) → `(Default, value)`.
+4. **Format default** — the format/application fallback → `(FormatDefault, value)`.
+
+Every property the inspector shows carries this `(provenance, value)`. "Reset to inherited" removes the local override so the property falls through to its inherited value. Editing a property adds/updates a local override. This resolution is also what Spec 06 will measure, since it runs on every inspector open and every dependent recompute.
+
+**The OOXML/ODF page-style asymmetry is a real design decision, not a detail.** ODF has named page styles (`style:page-layout` + `style:master-page`); OOXML has no named page-style equivalent — page setup lives in section properties (`sectPr`). The audit must decide how the unified model represents page styling across both, and how the page-family panel presents it (likely ODF-native named page styles, mapped to OOXML sections on export). Flag this explicitly in the resolution-model ADR.
+
+---
+
+## 6. The Resolved-vs-Overridden Inspector
+
+The headline surface. For the selected style, list **every** applicable property — not just locally-set ones (the current panel's central failing) — each row showing:
+
+- the property and its **resolved value**;
+- a clear **provenance indicator**: Local · Inherited from *⟨ancestor name⟩* · Default;
+- for inherited/default rows, the edit affordance creates a local override;
+- for local rows, a one-click **reset-to-inherited** that removes the override.
+
+Provenance must be glanceable — a user should see at a glance which properties this style actually *owns* versus passively receives. Inherited rows should let the user **jump to the ancestor** that sets the property (this is the "identify where a property is set, change it for all dependents" workflow). Display uses each style's localized **display name**, while all operations key on the stable internal **style id** (respecting the existing `COMPAT(i18n)` annotations on internal match keys like "Default Paragraph Style").
+
+Edits are **staged**, not live (§12) — the inspector shows pending overrides distinctly from committed ones until Apply.
+
+---
+
+## 7. The Inheritance Tree View
+
+A view of the family's inheritance tree, for understanding and managing structure:
+
+- **Visualize** the parent→child hierarchy; select a node to inspect it (§6).
+- **Propagation is the point.** Changing a property on a base style changes it for every descendant that doesn't locally override it. The tree makes the affected subtree visible.
+- **Impact preview before Apply.** When a staged edit to a base style would affect dependents, show *how many* and *which* dependent styles change before the user commits. No surprise cascades.
+- **Re-parenting.** Let the user change a style's parent (`basedOn` / `parent-style-name`); the inspector re-resolves and the impact preview shows the consequence. Guard against cycles (single-parent + cycle check keeps the tree a tree).
+
+On Compact, the full tree is impractical; it degrades to a breadcrumb + drill-down (§11), not a shrunken graph.
+
+---
+
+## 8. Style Creation & Management
+
+"Make it easy to create reusable styles" is a primary goal, so creation is first-class:
+
+- **Create:** choose family → choose parent (defaulting sensibly within the family) → name it → the inspector opens showing everything inherited from the parent, ready to override selectively. Creating a style is "pick a parent and override what differs," which is the inheritance model working as intended.
+- **Manage:** rename (display name), re-parent (§7), delete (with dependent-impact warning — deleting a parent must handle its orphans predictably, e.g. re-parent to grandparent).
+- **Built-in vs. user styles:** built-in/default styles (the `COMPAT(i18n)` internal-keyed ones) may restrict deletion/rename; the audit determines the rules and the panel enforces them.
+
+---
+
+## 9. The Six Family Panels
+
+All six share the §6 inspector and §7 tree; they differ only in their **property set** and a few structural wrinkles:
+
+- **Paragraph** — alignment, indents, spacing, line height, borders, shading; references a linked character aspect for run defaults. *(Build first.)*
+- **Character** — font family/size/weight/style, color, underline, effects. *(Build first — paragraph+character exercise the whole inspector pattern.)*
+- **Linked** — the paragraph↔character cross-reference (OOXML `w:link`): one editing surface governing both aspects. Not inheritance; a distinct relationship the panel makes explicit.
+- **List / Numbering** — per-level definitions: numbering format, glyph, indents per level. A more complex, level-indexed surface reusing the inspector per level.
+- **Table** — table-wide formatting plus conditional regions (header row, banding, first/last column). The inspector extends to conditional-format slots. Only meaningful because tables render (cf. Spec 04's capability gate).
+- **Page** — the ODF/OOXML asymmetry from §5: named page styles (geometry + master page) presented ODF-native, mapped to OOXML sections on export.
+
+Equal depth isn't required in v1, but the **inspector pattern is uniform** across all six. Build order follows §4: framework + paragraph/character first, then linked/list/table/page reusing the proven pattern.
+
+---
+
+## 10. The Conditional-Panel Context Pattern (sanctioned)
+
+**This is the architectural deliverable Spec 03 deferred.** The problem: a panel rendered as a *plain function called inside an `if`*, with an early return, can't host a hook (`use_breakpoint()` included), and threading a `compact` flag down breached the `editor_inner.rs` ceiling.
+
+**Decision (D1): conditionally-shown panels are proper `#[component]`s, not plain functions called inside `if`.** A component owns its own hook scope, which Dioxus manages correctly across mount/unmount — so the component can call the resilient `use_breakpoint()` directly and read responsive context without any prop threading and without growing the parent. The parent mounts it conditionally at the component boundary (`{open().then(|| rsx! { StyleFamilyPanel { .. } })}`); the boundary handles hook scoping.
+
+Consequences:
+
+- Every family panel and sub-panel in this spec is a component from the start — born able to read the breakpoint.
+- No `compact` flag is threaded through `editor_inner.rs`; the ceiling pressure that forced the Spec 03 deferral disappears.
+- **This pattern retroactively unblocks Spec 03's R-13g** (metadata-panel label stacking): converting that plain-fn panel to a component lets it read the breakpoint the same way. Closing R-13g remains Spec 03's milestone; this spec only establishes the pattern it needs.
+
+The pattern is documented as a project convention so future conditionally-mounted surfaces follow it by default.
+
+---
+
+## 11. Phone / Compact Usability
+
+The panel must be fully usable at Compact (Spec 03's < 600 tier), which means it is not merely a narrowed desktop side panel:
+
+- **Posture:** at Compact the panel becomes a full-surface or bottom-sheet presentation rather than a side-by-side panel (no room beside the document). Within Blitz limits — no `position: fixed` (so the sheet lives in flow / via the patched mechanism, not pinned), no `box-shadow` (elevation via token border/background).
+- **Inspector rows** stack and meet `TOUCH_MIN` (44px, Spec 03) touch targets.
+- **Tree view** degrades to breadcrumb + drill-down (§7).
+- **Family/section navigation** within the panel uses a compact tab or segmented control so all six families and their property groups are reachable without horizontal scrolling.
+- **Decomposition under the 300-line ceiling is required**, not incidental: the inspector framework, each family panel, the tree view, and reusable property-row components are separate files/components. This both satisfies the ceiling and *is* the §10 pattern (each panel a component). The audit plans the decomposition before code is written.
+
+---
+
+## 12. Apply Model
+
+Keep the current **staged-edit + Apply** model (the maintainer confirmed it's adequate):
+
+- Property edits in the inspector are **staged**, shown distinctly from committed values.
+- **Apply** commits the staged overrides to the model (Loro), which propagates to dependents via resolution — the impact preview (§7) already told the user what that entails.
+- **Discard** reverts staged edits. Apply is per-panel batch, not per-property live-write.
+
+Live preview is *not* required; the explicit Apply is the intended model and keeps CRDT writes deliberate.
+
+---
+
+## 13. Key Decisions (ADR-style)
+
+**D1 — Conditional panels are components, not plain fns in `if`.** Fixes the Spec 03 context problem at its root, threads no flags, respects the ceiling, unblocks R-13g. Tradeoff: a small discipline (everything's a component) — which is idiomatic Dioxus anyway.
+
+**D2 — Inspector shows all properties with provenance, not just local ones.** Directly fixes the current panel's central failing; provenance is what makes inheritance reasonable-about. Tradeoff: more to render and resolve per open (Spec 06 measures it) — essential to the feature's purpose.
+
+**D3 — Inheritance is a tree (single-parent); linked styles are a separate cross-reference.** Matches both formats' actual model; cycle-guarded re-parenting keeps it a tree. Tradeoff: page styles don't fit the tree cleanly across formats (§5) — handled as an explicit asymmetry, not forced.
+
+**D4 — Impact preview before Apply.** Changing a base style is powerful; users see the blast radius first. Tradeoff: computing affected dependents on stage — cheap relative to the value of no surprise cascades.
+
+**D5 — Staged Apply, no live preview.** Confirmed-adequate, keeps CRDT writes deliberate. Tradeoff: less immediate than live — accepted; deliberate is correct for shared/named styles.
+
+**D6 — All six families, uniform inspector; paragraph/character first.** Covers all styling needs with one pattern. Tradeoff: list/table/page surfaces are complex — phased after the pattern is proven, equal depth not required in v1.
+
+---
+
+## 14. Milestones & Acceptance Criteria
+
+**M1 — Resolution layer.** Provenance-aware resolution (Local/Inherited-from/Default/FormatDefault) over the single-parent tree; the page-style asymmetry decided in an ADR. *Accept:* given a style and property, the layer returns the correct value *and* provenance, including multi-level inheritance; cycles are impossible.
+
+**M2 — Inspector.** All applicable properties shown with provenance; reset-to-inherited; edit-creates-override; jump-to-ancestor; staged display; display-name UI over id operations. *Accept:* an inherited property is visibly distinguished from a local one, names its source ancestor, and resets cleanly; the current "local-only" blindness is gone.
+
+**M3 — Conditional-panel pattern.** §10 established and documented; the inspector and a first family panel are components reading the breakpoint with no parent prop-threading. *Accept:* a conditionally-mounted panel reads the correct breakpoint at Compact and Expanded without growing `editor_inner.rs`; the pattern is written down as a convention.
+
+**M4 — Tree view + propagation.** Hierarchy visualization, impact preview, cycle-guarded re-parenting. *Accept:* editing a base style's property previews the exact dependent set affected before Apply; re-parenting re-resolves and can't form a cycle.
+
+**M5 — Creation & management.** Create (family→parent→name→override), rename, re-parent, delete-with-orphan-handling; built-in-style rules enforced. *Accept:* a new style created from a parent shows all inherited values ready to override; deleting a parent handles dependents predictably.
+
+**M6 — Six family panels.** Paragraph + character first, then linked/list/table/page on the shared inspector; linked cross-reference explicit; page family per the §5 decision. *Accept:* all six families are editable through the uniform inspector; linked styles govern both aspects; table conditional regions are reachable.
+
+**M7 — Compact usability.** Bottom-sheet/full-surface posture, touch targets, breadcrumb tree, compact navigation, ceiling-compliant decomposition. *Accept:* the full panel — including the tree and all six families — is operable at < 600 width with no horizontal scrolling and 44px targets.
+
+---
+
+## 15. Out of Scope
+
+- "Update style to match selection" (not useful under Loki's no-direct-formatting philosophy).
+- The direct-formatting → named-style cleanup tool (deferred to its own future spec).
+- Adding style properties the renderer can't honor (audited out, like Spec 04's Insert gate).
+- Style *application* / quick-styles UX (→ Spec 04).
+- Re-verifying style round-trip fidelity (→ Spec 02).
+- Closing Spec 03's R-13g itself (this spec provides the pattern; R-13g remains Spec 03's milestone).
diff --git a/docs/adr/spec-06-benchmarking-and-memory-tracking.md b/docs/adr/spec-06-benchmarking-and-memory-tracking.md
new file mode 100644
index 00000000..dcfe951e
--- /dev/null
+++ b/docs/adr/spec-06-benchmarking-and-memory-tracking.md
@@ -0,0 +1,207 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 06 — Benchmarking & Continuous Memory Tracking
+
+| | |
+|---|---|
+| **Status** | Draft — pending implementation |
+| **Scope** | AppThere Loki (Text); the benchmark harness is shared monorepo infrastructure |
+| **Sequence** | 6 of 6 — specced last, but instrumented as a continuous concern from here on |
+| **Depends on** | Spec 01 (harness location at monorepo root, ADR 0009); Spec 02 (`vello_cpu` render proxy + the CPU/GPU parity check); Spec 05 (style resolution as a named target) |
+| **Feeds** | Ongoing optimization; no downstream spec |
+
+---
+
+## 1. Context & Motivation
+
+RAM is expensive and getting more so, and people hold onto budget and older hardware longer because of it. The design floor is a **MacBook Neo (A16, 8 GB RAM, 2026)** — a real device a real user edits documents on while also running a browser and an OS. Loki has to be a good citizen on that machine. This isn't abstract: an earlier tiered render-cache effort already cut steady-state RAM from **~2.83 GB to ~750 MB** by sharing `vello::Renderer`, `PaginatedLayout`, and `FontResources` behind `Arc`. That win is exactly the kind of thing that silently regresses without measurement — one careless clone and it's back to gigabytes.
+
+So this spec builds the instrumentation to (a) track performance across every operation that affects perceived responsiveness, and (b) **continuously track memory** so the 750 MB kind of win is defended, leaks are caught, and the app stays within a budget the 8 GB floor can afford. Respecting users' hardware budgets and extending device longevity through coding efficiency is the goal; measurement is how we hold ourselves to it.
+
+Two constraints shape everything:
+
+- **Local-only tracking.** Benchmarks are *not* CI gates. Hardware variance would make cross-machine pass/fail meaningless, so results are tracked locally and diffed against a committed baseline for human review — never a hard build failure. (Spec 01 already reserved benchmarking *out* of the gate set for this reason.)
+- **No GPU in the agent environment.** Some benches (GPU frame-time, real peak RSS) can only run on actual hardware; others (allocation metrics, model/layout/IO/style cost, `vello_cpu` render cost) run anywhere. The harness must cleanly separate the two so the portable set runs headless and the device-bound set runs on Kevin's hardware.
+
+This is **audit-first**: inventory what's measurable today, the existing caches and their bounding, and Loro history behavior, before building. References below are illustrative.
+
+---
+
+## 2. Relationship to Prior Specs (read first)
+
+- **Spec 02 — `vello_cpu` is a gift here.** Adopting `vello_cpu` gives a **deterministic, hardware-independent render-cost proxy** that runs headless in the agent environment. Production frame-time is still GPU and device-bound, but `vello_cpu` render cost is a portable signal for "did rendering get more expensive." This spec also **owns the cadence** of Spec 02's CPU/GPU parity check, since the two-Vello-crate pin (`vello` 0.6 + `vello_cpu`) can drift and the parity check is what catches it.
+- **Spec 05 — style resolution is a named target.** Provenance-aware resolution runs on every inspector open and every dependent recompute; on documents with deep inheritance chains and many styles it can get expensive. It is a first-class benchmark here (§6).
+- **The Arc-cache win is a guarded invariant.** Memory benches must assert the shared-`Arc` steady state doesn't regress toward the old 2.83 GB behavior.
+- **ADR 0009** governs layering; the harness lives at the **monorepo root** alongside the Spec 01 and Spec 02 shared infrastructure, so Presentation and Spreadsheet can bench too.
+
+---
+
+## 3. Goals / Non-Goals
+
+**Goals**
+
+- Benchmarks for every responsiveness-affecting operation: typing latency, scroll/render frame time, open/save, layout, export, and **style resolution**.
+- Continuous memory tracking via a committed baseline that each run diffs, leaning on portable allocation metrics.
+- Peak-RSS budgets per corpus tier, calibrated against the 8 GB floor.
+- Leak detection for the known culprits: `Arc` cycles, unbounded caches, Loro history growth.
+- A clean split between hardware-independent (agent-runnable) and hardware-dependent (device-only) benches.
+- The CPU/GPU parity-check cadence.
+
+**Non-Goals**
+
+- Any CI gate. Benchmarks never fail the build (§11).
+- Cross-machine result comparison (local-only; each machine tracks itself).
+- The optimizations themselves. This spec *measures*; fixes are separate work informed by the measurements (though the audit may surface obvious waste, as Spec 01 does).
+- Micro-optimizing anything the numbers don't flag.
+
+---
+
+## 4. Working Method
+
+1. **Inventory measurability.** What can be timed/profiled today; where the caches are and whether they're bounded (LRU/eviction); whether Loro history grows unbounded or compacts.
+2. **Build the harness** with the two-axis split (§5) at the monorepo root.
+3. **Stand up the portable benches** first (agent-runnable): allocation metrics, model/layout/IO/style/`vello_cpu` cost.
+4. **Stand up the device benches** (Kevin's hardware): GPU frame-time, real peak RSS.
+5. **Calibrate budgets** (§9) against the 8 GB floor and commit the baseline.
+6. **Establish the tracking discipline** (§11) and the parity cadence (§12).
+
+Standing standards apply throughout.
+
+---
+
+## 5. Two Axes: Portable vs. Device-Bound
+
+The harness sorts every bench into one of two axes, because *where it can run* and *how trustworthy its number is* differ sharply:
+
+| Axis | Metrics | Runs where | Portability |
+|------|---------|------------|-------------|
+| **Portable** | heap allocation bytes/counts (dhat), model/layout/IO/style op counts, `vello_cpu` render cost | Agent, CI-like, any dev machine | High — allocation *bytes and counts* are largely hardware-independent |
+| **Device-bound** | GPU frame-time, wall-clock latency, real peak RSS | Kevin's hardware (Windows+RTX 3050, MacBook A16) | Low — varies by CPU/GPU/driver |
+
+**Key insight (D1): allocation metrics are portable in a way timing is not.** dhat reports *bytes allocated* and *allocation counts*, which barely move across machines — so **continuous memory tracking leans on allocation metrics as its primary tracked signal**, with peak RSS as a device-local reality check. This is what makes memory "continuously trackable" despite the local-only constraint: the portable signal can be diffed meaningfully over time, while timing/RSS are local reference points.
+
+---
+
+## 6. Benchmark Targets
+
+Every operation the maintainer named, each tagged with its axis:
+
+- **Typing latency** — keystroke → model update → layout → render-ready. *Portable* for the model+layout portion (op cost, allocations); *device-bound* for the wall-clock-to-pixels tail.
+- **Scroll / render frame time** — *device-bound* (production GPU path); shadowed by the *portable* `vello_cpu` render-cost proxy for "did rendering get heavier."
+- **Open / save** — parse/serialize + IO. *Portable* (allocations, parse op cost); IO wall-clock is *device-bound*.
+- **Layout** — text layout (Parley) + pagination (`PaginatedLayout`). *Portable* (allocations, op cost).
+- **Export** — DOCX/ODT/PDF emission. *Portable* (allocations, op cost).
+- **Style resolution** (Spec 05) — inspector-open resolution and dependent recompute, stressed on deep inheritance chains and many styles. *Portable*. Watch for super-linear behavior as chain depth × style count grows.
+
+Criterion drives the timed benches (it handles variance statistically); dhat wraps the allocation-tracked ones.
+
+---
+
+## 7. Continuous Memory Tracking (the real goal)
+
+- **Committed baseline + diff.** A checked-in baseline of the portable memory metrics per corpus tier; each run diffs against it and surfaces deltas for review. The baseline is updated *intentionally* (committed) when a change legitimately shifts it — never silently.
+- **Steady-state guard.** Assert the shared-`Arc` steady state (the 750 MB-class behavior) holds; flag regressions toward per-instance duplication of `Renderer`/`PaginatedLayout`/`FontResources`.
+- **Leak detection** for the three known culprits:
+  - **`Arc` cycles** — long-session tests that open, edit, and *close* a document, asserting memory returns to near-baseline. A cycle shows up as a document that never frees.
+  - **Unbounded caches** — assert the render/font/layout caches actually evict (bounded LRU), not grow forever; the pathological corpus (§8) drives this.
+  - **Loro history growth** — a long editing-session bench measuring whether CRDT history grows unbounded, and whether compaction/GC (if any) engages. This is the sneakiest, because it grows with session *time*, not document size.
+
+---
+
+## 8. The Benchmark Corpus
+
+A **scale** corpus, distinct from Spec 02's *feature-coverage* fixtures (benchmarking stresses size; conformance stresses breadth). Four tiers:
+
+| Tier | Shape | Flushes out |
+|------|-------|-------------|
+| **Small** | a page or two | baseline overhead, fixed costs |
+| **Medium** | tens of pages | typical working-document behavior |
+| **Large** | hundreds of pages | scaling, cache pressure |
+| **Pathological** | huge tables, thousands of styles, deep inheritance chains, massive Loro history, many images | leaks, super-linear algorithms, unbounded growth |
+
+The pathological tier is where the important bugs live — it's deliberately abusive. Where a Spec 02 fixture usefully doubles as a small input it may be reused, but the large/pathological tiers are generated for scale.
+
+---
+
+## 9. Budgets & Calibration
+
+**Decision (D2): budgets are calibrated against the 8 GB floor, not guessed** — the same anti-magic-number discipline as Spec 02's threshold and Spec 01's dimension constants.
+
+- Express a **peak-RSS budget per corpus tier** (e.g. "a large document edits under *X* MB peak RSS"), where *X* is set by measuring current behavior and targeting headroom that lets Loki coexist with an OS and a browser on 8 GB. The ~750 MB steady-state reference suggests sub-gigabyte budgets are achievable for realistic tiers.
+- The calibration record — measured distributions, chosen budgets, device, date, tool versions — is committed, like Spec 02's.
+- Budgets are **review targets**, not gates: exceeding one prompts a look, not a failed build.
+
+---
+
+## 10. Tooling
+
+- **Criterion** — timed benches; statistical handling of variance suits the noisy local environment.
+- **dhat** — Rust-native heap profiling; portable allocation bytes/counts; the backbone of continuous memory tracking. (heaptrack/massif remain options for deep local investigation, but dhat is the integrated, portable default.)
+- **Peak RSS** — OS-level measurement (`/proc` on Linux, platform API on macOS), device-bound.
+- **GPU frame-time** — wgpu timestamp queries / frame pacing on real hardware; **not** agent-runnable.
+- **`vello_cpu` render cost** — Criterion-timed, portable render-complexity proxy (from Spec 02's rasterizer).
+
+---
+
+## 11. Local-Only Tracking Discipline
+
+**Decision (D3): benchmarks are tracked, not gated.** This is a deliberate departure from Spec 01's hard CI gates, forced by hardware variance:
+
+- Runs are **local**; results diff against the committed baseline.
+- Regressions are **surfaced for human review**, not enforced — no benchmark ever fails CI.
+- The **baseline is a committed artifact** updated intentionally, so history shows how performance and memory move over releases. This *is* the "continuous" in continuous tracking: a portable signal (§5) tracked over time in version control.
+- The discipline is: run locally before/after significant changes, diff, review deltas, update the baseline with intent when a shift is justified and explained.
+
+This gives regression *visibility* without the false-failure noise a hardware-sensitive gate would produce.
+
+---
+
+## 12. The `vello_cpu` / GPU Parity Cadence
+
+Spec 02 introduced a second render path (`vello_cpu`) alongside the production GPU path, and flagged that the two pinned Vello crates can drift as they version forward. The CPU/GPU parity check (same scene both ways, expected to agree within tolerance) is what catches that drift — and it needs a **cadence**, which this spec owns:
+
+- Run the parity check **on every Vello version bump** and on a regular local cadence, on Kevin's GPU hardware (it needs a GPU).
+- A parity divergence is a signal that the crates have drifted or a render change affects the paths differently — investigated, not ignored.
+- This keeps Spec 02's conformance goldens trustworthy (they're rendered on `vello_cpu`, so `vello_cpu` must stay faithful to what users see on GPU).
+
+---
+
+## 13. Key Decisions (ADR-style)
+
+**D1 — Allocation metrics are the portable memory signal; RSS is a device-local check.** Bytes/counts barely vary by hardware, so they're what's continuously tracked; RSS is a reality check on real devices. Tradeoff: allocation metrics don't capture fragmentation/RSS overhead — covered by the device-local RSS check.
+
+**D2 — Budgets calibrated against the 8 GB floor, not guessed.** Measured targets with headroom to coexist on the floor device; committed calibration record. Tradeoff: a calibration step before budgets mean anything — worth it to avoid arbitrary numbers.
+
+**D3 — Tracked, not gated.** Hardware variance makes cross-machine pass/fail meaningless; a committed baseline diffed locally gives visibility without false failures. Tradeoff: no automatic enforcement — mitigated by the review discipline and the committed baseline's visible history.
+
+**D4 — Scale corpus separate from the conformance corpus.** Benchmarking stresses size; conformance stresses breadth; the pathological tier is deliberately abusive. Tradeoff: another corpus to maintain — necessary, since feature fixtures don't exercise scale.
+
+**D5 — `vello_cpu` doubles as a portable render proxy; this spec owns the parity cadence.** Reuses Spec 02's rasterizer for a hardware-independent render signal and keeps the two render paths honest. Tradeoff: the proxy isn't the production path — that's why device-bound GPU frame-time is still measured.
+
+---
+
+## 14. Milestones & Acceptance Criteria
+
+**M1 — Harness + two-axis split.** Benchmark harness at the monorepo root; portable vs. device-bound axes cleanly separated; Criterion + dhat wired. *Accept:* the portable set runs headless in the agent environment with no GPU; the device set is clearly marked as hardware-only.
+
+**M2 — Portable benches.** Model/layout/IO/export/style-resolution op-cost and allocation benches; `vello_cpu` render-cost proxy. *Accept:* each named §6 target has a portable bench producing stable allocation metrics; style resolution is stressed on deep chains × many styles and its scaling is visible.
+
+**M3 — Continuous memory tracking.** Committed portable-metric baseline per corpus tier; diff-and-review flow; the Arc steady-state guard. *Accept:* a deliberate regression (e.g. cloning a `Renderer` instead of sharing the `Arc`) shows up as a baseline delta; the guard flags it.
+
+**M4 — Leak detection.** Long-session open/edit/close returns to near-baseline (Arc cycles); caches proven bounded under the pathological tier; Loro history-growth bench. *Accept:* a seeded leak (a retained document, an unbounded cache) is caught; Loro history behavior over a long session is measured and reported.
+
+**M5 — Device benches + budgets.** GPU frame-time and peak-RSS on Kevin's hardware; per-tier RSS budgets calibrated against the 8 GB floor; calibration record committed. *Accept:* frame-time and peak RSS are measurable on real hardware; budgets trace to the calibration data, not a guess.
+
+**M6 — Discipline + parity cadence.** The tracked-not-gated discipline (§11) documented; the CPU/GPU parity cadence (§12) established. *Accept:* the baseline-update discipline is written down; the parity check has a defined trigger (Vello bump + regular cadence) and a divergence is actionable.
+
+---
+
+## 15. Out of Scope
+
+- Any CI gate or automatic build failure from benchmarks (§11).
+- Cross-machine result comparison.
+- The optimizations themselves (measurement informs them; they're separate work).
+- Adding new caches or changing the render architecture (measured here, changed elsewhere).
+- Presentation/Spreadsheet benchmark suites (the harness is shared; their corpora/suites are their own work, as with Spec 02).
diff --git a/docs/adr/spec-06-benchmarking-audit.md b/docs/adr/spec-06-benchmarking-audit.md
new file mode 100644
index 00000000..61236301
--- /dev/null
+++ b/docs/adr/spec-06-benchmarking-audit.md
@@ -0,0 +1,246 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 06 — Benchmarking & Continuous Memory Tracking: Audit Report
+
+| | |
+|---|---|
+| **Status** | Audit complete; **no code changes**. Ground-truth inventory + finding register (**BM-1 … BM-14**) + triaged M1–M6 readiness below. |
+| **Method** | Audit-first per Spec 06 §1/§4.1: inventory what is measurable today, where the caches are and whether they are bounded, and how Loro history behaves — before building the harness. |
+| **Companion** | [spec-06-benchmarking-and-memory-tracking.md](spec-06-benchmarking-and-memory-tracking.md) (the design spec) |
+| **Precedent** | Same audit-then-triage flow as [spec-01](spec-01-audit-report.md) / [spec-02](spec-02-conformance-inventory.md) / [spec-05](spec-05-style-audit.md). |
+| **Primary source** | [docs/memory-audit-2026-06-12.md](../memory-audit-2026-06-12.md) — a prior code-level RAM audit (Findings 1–7) this report builds on. |
+
+This report establishes ground truth. It makes **no code changes** — implementation
+waits for triage. The headline deliverables are the **measurability inventory**
+(§1), the **cache-bounding table** (§2), the **Loro-history verdict** (§3), and one
+**upstream-dependency correction** (BM-3: the portable `vello_cpu` render proxy the
+spec leans on does not exist yet).
+
+---
+
+## 1. Measurability inventory — what can be benched today
+
+| Capability | State today | Gap for Spec 06 |
+|---|---|---|
+| Timed micro-benches | `loki-layout` has Criterion wired (`criterion = "0.8"`, 2 targets: `layout_scaling`, `edit_path`) | Only layout is covered; no IO/export/style benches; Criterion is not a workspace-wide dev-dep |
+| Open-latency bench | `loki-acid/examples/load_bench.rs` — hand-rolled `Instant` timing of the open→layout-ready pipeline, with **cold-open vs warm-reopen** stages; `relayout_bench.rs` alongside | Ad-hoc `eprintln!` reporting, not Criterion; example, not a tracked bench |
+| On-device open tracing | `loki_text::open` tracing spans on the real editor open path (`editor_load` / `editing::state`) | Spans exist; nothing captures/diffs them |
+| Allocation profiling (dhat) | **Absent entirely** — no `dhat` dependency anywhere in the workspace | The entire continuous-memory backbone (§7/D1) must be added from scratch |
+| Peak-RSS measurement | **Absent**; `log_memory_counters` logs Loro op/change counters, not RSS | M5 device work; needs `/proc` (Linux) + platform API (macOS) |
+| Scale corpus | **Absent**; only Spec 02 feature fixtures + `acid_docx.docx` exist | The 4-tier scale corpus (§8) must be generated |
+| Root bench harness | **Absent**; benches are scattered per-crate | M1: the two-axis harness at the monorepo root (`loki-acid` is the closest existing shared harness and is a workspace member) |
+
+**Verdict:** the raw signals exist in pieces (Criterion in one crate, a hand-rolled
+open bench, on-device tracing spans), but there is **no shared harness, no dhat, no
+baseline, and no scale corpus**. Spec 06 is a greenfield build on top of scattered
+precedent, not a wiring-up of existing infrastructure.
+
+---
+
+## 2. Cache inventory & bounding (the §7 leak-detection targets)
+
+| Cache | Location | Bounded? | Notes |
+|---|---|---|---|
+| Paragraph shaping cache | `loki-layout` `ParaCache` (`para_cache.rs`) | ✅ **Yes** | Two-generation approximate-LRU, `CACHE_CAP = 2048` × 2 gens; rotates on fill; `clear()` on document load (`clear_paragraph_cache`). Memory audit Finding 4 (**Fixed**). |
+| GPU page-texture tiers | `loki-renderer` (`CacheTier` Hot/Warm/Cold, `assign_tier`) | ✅ **Yes (post-fix)** | Bounded to the viewport neighbourhood after Finding 1's initial-retier fix (~240 MB → ~45 MB for a 20-page doc). Device-bound (GPU); a portable bench cannot see it. |
+| Page-tile virtualization | `loki-renderer/virtualize.rs` (`visible_window`) + `document_view.rs` | ✅ **Yes (now wired)** | `visible_window` restricts mounted tiles to the viewport neighbourhood with page-sized placeholders elsewhere — memory audit Finding 2 (was *Recommended*) is now **implemented**. |
+| Inactive-tab preserved layout | `DocSession.paginated_layout: Arc<PaginatedLayout>` | ⚠️ **Retained** | Every inactive tab stashes its full layout (~9 MB/20pp). Finding 3 — *Recommended, not yet fixed*. A candidate memory-bench target (BM-8). |
+| Per-tile font-byte cache | `LokiPageSource`'s own `FontDataCache` | ⚠️ **Duplicated** | Interned font bytes duplicated across tiles; `DocPageSource` holds a shared `font_cache` but tiles don't all route through it. Finding 5 — *Recommended, not yet fixed* (BM-9). |
+| Render primitives | `loki-render-cache` | n/a | `PageSource`/`GpuTexture` primitives (gpu-feature), not an unbounded collection. |
+
+**Verdict:** the two caches most likely to grow — the shaping cache and the GPU
+texture tiers — are **bounded and proven**, and virtualization is now wired. Two
+*recommended-but-unfixed* wastes remain (inactive-tab layouts, per-tile font bytes);
+the pathological-tier leak benches (§7) should assert the bounded caches stay bounded
+and quantify the two unfixed ones so the fix work (separate) has a number.
+
+---
+
+## 3. Loro history behavior — the sneakiest grower
+
+- **The oplog never compacts.** Every keystroke appends ops to the Loro oplog, and
+  deleted characters leave tombstones in the rich-text CRDT tree; **neither is ever
+  compacted** (memory audit Finding 6). Resident memory grows with edit *history*
+  during a long single-document session — the §7 "grows with time, not size" culprit,
+  confirmed in source.
+- **Undo is bounded.** `UndoManager` is capped (`max_undo_steps(100)`), so undo
+  history itself is not the unbounded grower — the oplog/tombstones are (BM-7).
+- **Instrumentation already exists.** `apply_mutation_and_relayout` →
+  `log_memory_counters` logs throttled (1-per-64-mutations) `loro_ops` / `loro_changes`
+  counters under the `loki_text::mem` target, explicitly so "`loro_ops` climbing while
+  `pages`/`blocks` stay flat" confirms history is the grower. **The M4 Loro-history
+  bench can read these counters directly** rather than inventing new telemetry.
+- **Compaction is proposed, not done.** `TODO(loro-compaction)`: drop history before a
+  frontier via `export(ExportMode::shallow_snapshot(&doc.oplog_frontiers()))` re-imported
+  into a fresh `LoroDoc`, at a save/undo-horizon checkpoint. Deferred because it
+  invalidates the `UndoManager` / `IncrementalReader` / live signals and needs on-device
+  validation. **Out of scope for Spec 06** (measurement, not fix) — but the M4 bench is
+  what will justify and later validate it.
+
+---
+
+## 4. Arc steady-state — the guarded invariant (Spec §2, §7)
+
+Confirmed in source — the three resources the spec names are shared behind `Arc`, not
+per-instance:
+
+- `shared_renderer: Arc<Mutex<Option<vello::Renderer>>>` (`renderer_state.rs`, threaded
+  through `page_tile.rs` / `page_paint_source.rs`).
+- `paginated_layout: Option<Arc<PaginatedLayout>>` (`editing/state.rs`, `document_view.rs`,
+  `sessions.rs`) — one layout shared by the editor and the paint path (the
+  "single canonical layout").
+- `shared_font_resources: Arc<Mutex<FontResources>>` (`editing/state.rs`).
+
+**M3's steady-state guard is well-founded:** the invariant is real and localizable, so
+a deliberate regression (cloning a `Renderer` instead of cloning the `Arc`) is a
+detectable allocation-count delta. **Caveat (BM-14):** the "~2.83 GB → ~750 MB" and
+">3 GB idle" figures in the spec and the memory audit are **code-level estimates, not
+profiled** (the headless environment has no GPU); the idle >3 GB grower was ultimately
+Finding 7 (a per-frame idle render loop, since **Fixed**), *not* Arc duplication. M5
+must **re-measure on-device** before those numbers anchor any budget.
+
+---
+
+## 5. Two-axis feasibility & the `vello_cpu` gap (BM-3)
+
+The portable axis is feasible for everything **except** the render proxy:
+
+- **Allocation metrics (dhat), model/layout/IO/export/style op-cost** — all pure-CPU,
+  headless-runnable today. Portable axis is green for these.
+- **`vello_cpu` render-cost proxy — dependency unmet.** Spec 02's `vello_cpu` candidate
+  render path is **specced but not implemented**: `spec-02-conformance-testing.md` is
+  *"Draft — pending implementation"* and states the CPU rasterizer is *"a genuinely new
+  render path — Loki does not have one today"*. In `appthere-conformance`, `golden/mod.rs`
+  **describes** a `vello_cpu` candidate render, but the crate's `Cargo.toml` has **no
+  `vello`/`vello_cpu` dependency** and no render body — it is doc scaffolding only. The
+  only `vello_cpu` in the tree is `anyrender_vello_cpu` inside `patches/dioxus-native`
+  (Blitz's own softbuffer path), not a first-party render-cost proxy.
+  **Consequence:** Spec 06 M2's `vello_cpu` render-cost bench and M6's parity cadence are
+  **blocked on Spec 02 landing the CPU path first.** Everything else on the portable axis
+  can proceed independently; this one target waits or Spec 06 co-delivers the CPU entry
+  point with Spec 02.
+- **Device-bound axis** (GPU frame-time, peak RSS) is correctly un-runnable here and
+  belongs on Kevin's hardware, exactly as the spec sorts it.
+
+---
+
+## 6. Style-resolution cost (Spec 05 target, §6)
+
+`loki-doc-model/src/style/resolve.rs` — `resolve_para_chain` / `resolve_char_chain`
+walk the parent chain on **every call**, with **no memoization** (grep for
+`cache`/`memo` in `resolve.rs` is empty). This matches the spec's premise that
+resolution "runs on every inspector open and every dependent recompute." It is a clean
+**portable** target: pure CPU, deterministic, allocation-trackable. The M2 stressor
+should scale **chain depth × style count** independently (the pathological tier's
+"thousands of styles, deep inheritance chains") and watch for super-linear growth —
+each resolve is O(depth), and `dependents_affected` (M4 impact) is O(styles × depth),
+so a naive inspector-open over a deep, wide catalog is the thing to measure.
+
+---
+
+## 7. Finding register (BM-1 … BM-14)
+
+| # | Finding | Bears on |
+|---|---|---|
+| **BM-1** | No root bench harness; benches scattered (Criterion in `loki-layout` only; hand-rolled `Instant` examples in `loki-acid`). | M1 |
+| **BM-2** | `dhat` absent workspace-wide — the continuous-memory backbone is greenfield. | M1, M3 |
+| **BM-3** | **`vello_cpu` render proxy not implemented** (Spec 02 pending); M2 proxy + M6 parity cadence are blocked upstream. | M2, M6 |
+| **BM-4** | Shaping cache (`ParaCache`) is bounded (2-gen ~LRU, cap 2048, cleared on load) — assert it *stays* bounded under the pathological tier. | M4 |
+| **BM-5** | GPU texture tiers + tile virtualization are bounded/wired (Findings 1 & 2) but **device-bound** — a portable bench can't observe GPU memory. | M2, M5 |
+| **BM-6** | Loro oplog/tombstones never compact (Finding 6); throttled `loki_text::mem` counters already exist for the M4 bench to consume. | M4 |
+| **BM-7** | `UndoManager` bounded to 100 steps — a guardable invariant, distinct from the oplog grower. | M4 |
+| **BM-8** | Inactive-tab `Arc<PaginatedLayout>` retained (Finding 3, unfixed) — a memory-bench target to quantify. | M3, M4 |
+| **BM-9** | Per-tile `FontDataCache` duplicates font bytes (Finding 5, unfixed) — steady-state guard should watch font-byte dedup. | M3 |
+| **BM-10** | Style resolution recomputed per call, no memoization — confirmed portable target; watch super-linear on depth × count. | M2 |
+| **BM-11** | Open-latency measurability exists (`load_bench` cold/warm stages + `loki_text::open` spans) — M2 open/save bench should reuse, not reinvent. | M2 |
+| **BM-12** | No scale corpus — the 4-tier corpus (esp. pathological) must be generated; Spec 02 fixtures only double as the Small tier. | M2, M4 |
+| **BM-13** | No committed baseline artifact or diff tooling — the "continuous" mechanism (§11) is entirely to build. | M3 |
+| **BM-14** | Headline RAM figures (2.83 GB→750 MB; >3 GB idle) are **code-level estimates, not profiled**; the idle grower was Finding 7 (fixed), not Arc duplication. Re-measure on-device before budgets. | M5 |
+
+---
+
+## 8. Triaged M1–M6 readiness
+
+1. **M1 — Harness + two-axis split.** *Ready.* Greenfield at the monorepo root; wire
+   Criterion (already in `loki-layout`) workspace-wide and add `dhat`. Model the axis
+   split on the portable/device table (§5). Reuse `loki-acid`'s fixture-loading
+   precedent. Blockers: none.
+2. **M2 — Portable benches.** ✅ **Shipped** (except the blocked proxy). Five
+   `harness = false` allocation benches in `loki-bench/benches/`, each measuring a
+   §6 target via `loki_bench::measure` over the scale corpus (`benches/support/`):
+   `portable_style_resolution` (the headline — sweeps depth × chains, and the
+   depth×count scaling is visible: `depth=64 chains=1000` → ~3.4 MB / 38 000
+   allocs, `depth=1` resolves Local with **zero** allocations),
+   `portable_layout` (cold-cache `layout_document`), `portable_model`
+   (`loro_to_document` rebuild), `portable_io` (DOCX save + open), and
+   `portable_export` (DOCX vs ODT emission). All run headless and produce stable
+   allocation metrics. **One target still blocked:** the `vello_cpu` render-cost
+   proxy waits on Spec 02 (BM-3) — deferred, not built here.
+3. **M3 — Continuous memory tracking.** ✅ **Shipped.** A committed per-tier baseline
+   (`loki-bench/baselines/portable.txt`, 18 curated keys — a representative metric per
+   §6 target × Small/Medium/Large, plus the Arc guard metric) with a pure, tested
+   diff engine (`baseline` module: parse/render round-trip + `diff` classifying
+   New/Removed/Regressed/Improved/Unchanged under a jitter tolerance — counts tight,
+   bytes looser for DOCX zip drift; 7 unit tests). The `baseline` bench collects the
+   samples, diffs against the committed file, and prints deltas for **review** (never
+   a CI failure, §11); `-- --update` rewrites the baseline intentionally. The **Arc
+   steady-state guard** (`arc_steady_state` bench) asserts `Arc::clone` of a real
+   shared resource allocates **zero** (audit §4); the same metric is tracked in the
+   baseline, so a value-clone regression turns 0 → nonzero = `+INF` = Regressed
+   (proven end-to-end and in `arc_share_replaced_by_value_clone_is_flagged`).
+4. **M4 — Leak detection.** ✅ **Shipped.** A residual live-heap primitive
+   (`leak` module: `residual_after` measures the heap still held after N cycles;
+   pure `classify_leak` verdict — Bounded vs Leaking — 4 unit tests) drives two
+   benches. `leak_detection` covers the Arc-cycle and unbounded-cache culprits:
+   the real open→edit→close cycle returns to **0 B** residual (leak-free — loro
+   fully frees on drop), while a **seeded** retained-document leak (1.9 MB → 124 MB
+   over 1→64 cycles) and a **seeded** unbounded cache (64 KB → 4.2 MB) are both
+   flagged `Leaking` — the acceptance. `leak_loro_history` measures and reports the
+   third culprit: 5 000 keystrokes grow the oplog +10 000 ops (2/keystroke, ~550 B
+   each) with the document length stable, quantifying Finding 6 /
+   `TODO(loro-compaction)` — the yardstick a future compaction fix is validated
+   against. (BM-4/BM-5's production `ParaCache`/GPU-tier boundedness stays where it
+   is proven — the loki-layout `ParaCache` unit tests and, for the device tiers,
+   M5; the seeded unbounded cache here proves the *detector*.)
+5. **M5 — Device benches + budgets.** ✅ **Shipped (agent-runnable half); GPU
+   frame-time device-gated.** Peak-RSS plumbing (BM-1) built and **verified in the
+   agent**: `rss` module (Linux `/proc/self/status` `VmHWM`/`VmRSS`, pure parser +
+   3 tests) drives the `device_rss` bench, which measures peak RSS per tier
+   (agent: small 9.3 / medium 12.1 / large 22.9 MiB) and reviews it against the
+   committed budgets (`baselines/rss_budgets.txt`). The budget mechanism (`budget`
+   module: `check`/`headroom_frac` + `Budgets` parse/render, 4 tests) calibrates
+   budgets at 1.5× measured peak (`-- --update`) and reviews-not-gates (§11). The
+   calibration record is committed ([spec-06-calibration.md](spec-06-calibration.md)):
+   measured distributions, device/date/tool versions, chosen budgets — with the
+   explicit **BM-14 caveat that agent numbers under-count real devices (no GPU
+   textures)** and Kevin must re-run on the Windows+RTX 3050 / MacBook A16 (adding
+   the macOS/Windows RSS readers) before budgets are authoritative. **GPU
+   frame-time** stays device-only (wgpu timestamp queries; `device_frame_time`
+   behind the `device` feature) — the one M5 metric that cannot execute or be
+   verified headless, documented for the on-device pass.
+6. **M6 — Discipline + parity cadence.** ✅ **Shipped.** The tracked-not-gated
+   discipline (§11) and the CPU/GPU parity cadence (§12) are written down in
+   [spec-06-discipline.md](spec-06-discipline.md): the before/after-change
+   run→review→intentional-update workflow over the committed artifacts, and the
+   parity triggers + actionable divergence response. The §12 "on every Vello bump"
+   trigger is made **mechanical**: the `parity` module (pure `vello_version_from_lock`
+   / `parity_status` / marker parse+render, 6 tests) drives the `parity_status`
+   bench, which reads the pinned `vello` (0.6.0) from `Cargo.lock`, compares it to
+   the committed `parity_marker.txt`, and flags a bump as `[DUE]` — headless, so the
+   trigger is verifiable in the agent. **Honest state:** the parity *check* still
+   needs a GPU + Spec 02's `vello_cpu` path (BM-3), so the marker is deliberately
+   **unconfirmed** and the tool correctly reports `[DUE]` for the current pin; the
+   trigger + process are in place, the check executes once Spec 02 lands the CPU
+   path.
+
+**Spec 06 status: M1–M6 all shipped** (agent-runnable scope). The only work that
+remains is genuinely device-/upstream-gated: GPU frame-time execution (M5, needs a
+GPU), on-device RSS recalibration (BM-14), and the `vello_cpu` render-cost proxy +
+parity-check execution (BM-3, gated on Spec 02).
+
+**Prerequisite call-outs** (so they are not discovered late): `dhat` integration and a
+baseline/diff mechanism (M1/M3, greenfield); the **scale corpus** generator, especially
+the pathological tier (M2/M4); and the **Spec 02 `vello_cpu` CPU render path** (BM-3),
+which gates the render-cost proxy and the parity cadence.
diff --git a/docs/adr/spec-06-calibration.md b/docs/adr/spec-06-calibration.md
new file mode 100644
index 00000000..bd435747
--- /dev/null
+++ b/docs/adr/spec-06-calibration.md
@@ -0,0 +1,79 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 06 — Peak-RSS Budget Calibration Record
+
+| | |
+|---|---|
+| **Status** | **Provisional** — measured in the headless agent; **awaits on-device recalibration** (BM-14). |
+| **Spec** | [spec-06-benchmarking-and-memory-tracking.md](spec-06-benchmarking-and-memory-tracking.md) §9 (Budgets & Calibration, decision D2) |
+| **Companion** | [spec-06-benchmarking-audit.md](spec-06-benchmarking-audit.md) (finding BM-14) |
+| **Artifact** | [`loki-bench/baselines/rss_budgets.txt`](../../loki-bench/baselines/rss_budgets.txt) (the committed per-tier budgets) |
+
+This is the committed calibration record §9 requires: the measured distributions,
+the chosen budgets, and the device / date / tool versions they trace to — so
+budgets are **traceable to data, not guessed** (D2). Budgets are **review
+targets, never CI gates** (§11).
+
+## Method (D2)
+
+`cargo bench -p loki-bench --bench device_rss` builds and lays out each corpus
+tier (held live) and reads the OS peak RSS (`/proc/self/status` `VmHWM`).
+`-- --update` writes each tier's budget as **1.5 × measured peak** (50% headroom
+over current behaviour). The 8 GB floor (MacBook Neo, A16, 2026) is the ceiling
+the budgets must respect: Loki has to coexist with an OS and a browser, so the
+target is **sub-gigabyte per realistic tier** — which the ~750 MB steady-state
+reference (the shared-`Arc` render-cache win) shows is achievable.
+
+## Measurement device (this record)
+
+| | |
+|---|---|
+| Environment | **Headless CI agent — Linux, no GPU** |
+| `rustc` | 1.94.1 |
+| `dhat` | 0.3.3 |
+| Date | 2026-07-04 |
+| Corpus | scale tiers: small 10 paras, medium 60, large 250 (`benches/support`) |
+
+## Measured peak RSS + chosen budgets
+
+Process baseline peak RSS: **2.4 MiB**.
+
+| Tier | Measured peak RSS | Budget (1.5×) |
+|------|-------------------|---------------|
+| small (10 paras) | 9.3 MiB | 13.9 MiB |
+| medium (60 paras) | 12.1 MiB | 18.2 MiB |
+| large (250 paras) | 22.9 MiB | 34.4 MiB |
+
+## ⚠️ Why these are provisional (BM-14)
+
+**These numbers are agent measurements and materially under-count real devices.**
+The agent has **no GPU**, so none of the resident cost that actually dominates on
+device is present:
+
+- **No GPU page textures** — the tiered render cache (Hot/Warm/Cold, the
+  ~240 MB→45 MB and >3 GB idle findings) is entirely device-side.
+- **Different allocator / OS accounting** than Windows or macOS.
+- **No wgpu / driver working set.**
+
+So the real device RSS is expected in the hundreds of MB (the ~750 MB
+steady-state class), not tens of MB. **Before these budgets are authoritative,
+Kevin must:**
+
+1. Run `cargo bench -p loki-bench --bench device_rss -- --update` on the
+   **Windows + RTX 3050** box and on the **MacBook A16** (add the macOS `getrusage`
+   / Windows `GetProcessMemoryInfo` reader — Spec 06 M5 §10; the Linux `/proc`
+   reader is done and verified).
+2. Commit the device budgets, updating this record with the device rows, and set
+   headroom so the large tier still leaves the 8 GB floor room for an OS + browser.
+
+Until then the committed budgets exercise the **mechanism** (measure → calibrate →
+review) with real-but-agent-local numbers; they are not device budgets.
+
+## GPU frame-time (the other M5 metric)
+
+GPU frame-time is device-only (wgpu timestamp queries on the production paint
+path) and **cannot run in the agent** — it is the `device_frame_time` target,
+gated behind the `device` feature, and is executed and recorded on Kevin's GPU
+hardware as part of the same on-device pass.
diff --git a/docs/adr/spec-06-discipline.md b/docs/adr/spec-06-discipline.md
new file mode 100644
index 00000000..dfe125c1
--- /dev/null
+++ b/docs/adr/spec-06-discipline.md
@@ -0,0 +1,119 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Spec 06 — Tracking Discipline & Parity Cadence
+
+| | |
+|---|---|
+| **Status** | Active — the standing process for Spec 06's benchmarks. |
+| **Spec** | [spec-06-benchmarking-and-memory-tracking.md](spec-06-benchmarking-and-memory-tracking.md) §11 (discipline, D3) + §12 (parity cadence, D5) |
+| **Tools** | `loki-bench` — `baseline`, `device_rss`, `leak_*`, `arc_steady_state`, `parity_status` |
+
+This is the written-down discipline (Spec 06 M6): how the benchmarks are run,
+reviewed, and committed, and when the CPU/GPU parity check must run. Two rules
+frame everything: **benchmarks are tracked, never gated** (§11), and the
+**parity check runs on every Vello bump** (§12).
+
+---
+
+## 1. Tracked, not gated (§11 / D3)
+
+Hardware variance makes a cross-machine pass/fail meaningless, so **no benchmark
+ever fails CI**. Instead, a committed baseline is diffed locally and regressions
+are surfaced for human review. The committed artifacts *are* the continuous
+record — their git history shows how memory and cost move over releases:
+
+| Artifact | What it holds | Tool |
+|---|---|---|
+| [`loki-bench/baselines/portable.txt`](../../loki-bench/baselines/portable.txt) | portable allocation metrics per §6 target × tier + the Arc-guard metric | `baseline` |
+| [`loki-bench/baselines/rss_budgets.txt`](../../loki-bench/baselines/rss_budgets.txt) | per-tier peak-RSS budgets (review targets) | `device_rss` |
+| [`loki-bench/baselines/parity_marker.txt`](../../loki-bench/baselines/parity_marker.txt) | Vello version last confirmed by a parity run | `parity_status` |
+| [`spec-06-calibration.md`](spec-06-calibration.md) | the RSS budget calibration record | — |
+
+### The workflow
+
+Run **before and after any significant change** (anything touching the model,
+layout, rendering, IO/export, style resolution, the shared-`Arc` caches, or a
+dependency bump — i.e. anything a §6 target exercises):
+
+```bash
+cargo bench -p loki-bench --bench baseline           # portable allocation diff vs committed baseline
+cargo bench -p loki-bench --bench arc_steady_state   # Arc::clone must allocate 0
+cargo bench -p loki-bench --bench device_rss         # peak RSS per tier vs budgets (device-local)
+cargo bench -p loki-bench --bench leak_detection     # open/edit/close leak-free; seeded leaks caught
+cargo bench -p loki-bench --bench leak_loro_history  # long-session oplog growth report
+```
+
+Then:
+
+1. **Review the deltas.** `baseline` prints `ok` / `improved` / `REGRESSED` per
+   key; `device_rss` prints headroom vs budget. A `REGRESSED` line or an `OVER`
+   budget is a prompt to look, not a failure.
+2. **Explain any real change.** A justified shift (a feature that legitimately
+   costs more, an intentional optimisation) is fine; an *unexplained* regression
+   is the thing to catch.
+3. **Update the baseline intentionally.** When a shift is understood and
+   accepted, regenerate and commit the artifact so it becomes the new reference:
+   ```bash
+   cargo bench -p loki-bench --bench baseline   -- --update
+   cargo bench -p loki-bench --bench device_rss -- --update   # on the measuring device
+   ```
+   Never update silently to make a diff "go away" — the commit that moves a
+   baseline should say *why*.
+
+That intentional, explained, committed update is the "continuous" in continuous
+tracking: the reference moves in version control, with a reason attached.
+
+---
+
+## 2. CPU/GPU parity cadence (§12 / D5)
+
+Spec 02 renders conformance goldens on `vello_cpu` while the app paints on GPU
+`vello`. The two pinned crates (`vello` 0.6 + `vello_cpu`) can drift as they
+version forward; the **parity check** — the same scene rendered both ways,
+expected to agree within tolerance — is what catches that drift and keeps the
+goldens trustworthy (they are only meaningful if `vello_cpu` stays faithful to
+what users see on GPU).
+
+### Triggers
+
+- **On every Vello version bump — mechanical.** `parity_status` reads the pinned
+  `vello` version from `Cargo.lock` and compares it to the last confirmed version
+  in `parity_marker.txt`; a bump prints **`[DUE]`**. Run it after any dependency
+  update:
+  ```bash
+  cargo bench -p loki-bench --bench parity_status
+  ```
+- **On a regular local cadence — calendar.** Run the parity check at least once
+  per release even without a bump, to catch drift a render change (not a version
+  change) could introduce.
+
+### Where it runs
+
+On **GPU hardware** (Kevin's Windows + RTX 3050 / MacBook A16) — the check needs a
+real GPU. The `parity_status` *trigger* is headless (it only reads versions), but
+the *check* it prompts is device-bound.
+
+### Responding to a divergence
+
+A parity divergence means the crates have drifted or a render change hits the two
+paths differently. It is **actionable, not ignorable**:
+
+1. Investigate the cause (crate drift vs. a scene/render change affecting CPU and
+   GPU differently).
+2. **Do not update `parity_marker.txt` until parity is restored.** The marker
+   records a *confirmed* run; recording an unconfirmed version would silently bless
+   drifted goldens.
+3. Once the check passes on device, record it:
+   ```bash
+   cargo bench -p loki-bench --bench parity_status -- --update   # note date/device/tolerance in the marker
+   ```
+
+### Current status (honest)
+
+The parity **check** cannot run yet: it needs a GPU *and* Spec 02's `vello_cpu`
+render path, which is still pending implementation (audit **BM-3**). So
+`parity_marker.txt` is intentionally **unconfirmed**, and `parity_status`
+correctly reports `[DUE]` for the current pin. The trigger and process are defined
+and in place now; the check executes once Spec 02 lands the CPU render path.
diff --git a/docs/audit-2026-06-10.md b/docs/audit-2026-06-10.md
index c2c4beba..e20ae26f 100644
--- a/docs/audit-2026-06-10.md
+++ b/docs/audit-2026-06-10.md
@@ -8,6 +8,17 @@ plus `patches/`. Build health at audit time: `cargo check --workspace` and
 Severity scale: **Critical** (active data destruction / remote-triggerable
 crash), **High**, **Medium**, **Low**.
 
+> **Status addendum (verified 2026-07-04 — see
+> [`deferred-features-audit-2026-07-04.md`](deferred-features-audit-2026-07-04.md)):**
+> the security/data-loss findings below have since been **resolved**: **S1/S2/S3**
+> (zip-bomb / ODS repeat / ODT attribute amplification) now enforce entry +
+> aggregate caps, `MAX_MATERIALIZED_*`, and checked arithmetic; **S4** (unbounded
+> ODT recursion) enforces `MAX_NESTING_DEPTH` (`odt/reader/document.rs`); and
+> **C1** (lists/tables/figures collapsing to horizontal rules on the first CRDT
+> write) is fixed — `loro_bridge/write.rs` writes native `Block::Table` etc. The
+> app-layer findings (F1–F7) were **not** re-verified in that pass; treat as
+> likely-open. Original findings preserved below unchanged.
+
 ---
 
 ## 1. Security (untrusted-document attack surface)
diff --git a/docs/deferred-features-audit-2026-07-04.md b/docs/deferred-features-audit-2026-07-04.md
new file mode 100644
index 00000000..e1831913
--- /dev/null
+++ b/docs/deferred-features-audit-2026-07-04.md
@@ -0,0 +1,181 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# Deferred-Features Audit — AppThere Loki (2026-07-04)
+
+| | |
+|---|---|
+| **Status** | Audit complete; **no code changes**. Inventory + verification of every documented deferral. |
+| **Scope** | First-party `loki-*` / `appthere-*` source + all `docs/` (specs, ADRs, prior audits, `CLAUDE.md`). Vendored `patches/` and `/target/` excluded. |
+| **Method** | Five parallel verification passes over (1) Rust `TODO(topic)` annotations, (2) `COMPAT` workarounds + dependency patches, (3) Spec 01–06 docs, (4) prior audit docs, (5) `fidelity-status.md` / tech-debt / MVP scope / format ADRs. **Every deferral was cross-checked against the current code** — the goal was not just to list them but to catch cases where a doc still says "deferred" but the code already does it. |
+| **Branch** | `claude/adr-docs-setup-ogwz5a` |
+| **Supersedes/extends** | [`docs/adr/spec-01-todo-compat-inventory.md`](adr/spec-01-todo-compat-inventory.md) (TODO/COMPAT catalogue, 2026-06-28) — still current and CI-enforced; this report adds verification + the doc-level deferrals it did not cover. |
+
+Counts at a glance: **~70 `TODO(topic)`** annotations (34 distinct deferrals), **~70 `COMPAT`** workarounds, **6** dependency patches, **35** files over the 300-line ceiling, and dozens of spec/audit/registry deferrals. The signal worth acting on first is **§1**.
+
+---
+
+## 1. Stale documentation — the code has moved on (ACTION: fix the docs)
+
+These are the audit's most important findings: places where a document still records something as **deferred / recommended / open / unsupported**, but verification shows the code **already implements it**. Correcting these prevents wasted "let's finally do X" effort and stops the docs from lying.
+
+| # | Doc claim (source) | Reality in code | Recommended fix |
+|---|---|---|---|
+| S-1 | `COMPAT(dioxus-native): position: absolute is unsupported in Blitz` (~5 sites: `appthere-ui/.../ribbon/group.rs:41`, `loki-text/.../editor_inner.rs:679,696`, `loki-renderer/src/page_tile.rs:105`, `.../editor_style_editor/form_font.rs:33`) | `CLAUDE.md` "Confirmed CSS properties" (2026-06-28, runtime-verified) states block-level `position: absolute` lays out, paints above the wgpu canvas, and hit-tests; the spelling context menu already relies on it. | Re-evaluate the flex/auto-margin fallbacks at those sites; update or drop the COMPAT notes. **Caveat:** absolute *inside an inline formatting context* is still unverified, and `position: fixed` genuinely still collapses to `absolute`. |
+| S-2 | `TODO(editing)` — `ParagraphStyle::next_style_id` "used by split_block to determine the style of the newly created paragraph after Enter" (`loki-doc-model/src/style/para_style.rs:53`) | Fully wired: `editor_keydown_ctrl.rs:200-224` resolves `next_style_id` and calls `set_block_style` on the new block. | Remove the stale `TODO(editing)`. |
+| S-3 | `TODO(super-sub)` "only font-size reduction applied" (`loki-layout/src/para.rs:177,870`) | `para_emit.rs:104,160` now also apply a manual `va_offset` vertical shift + per-glyph `w:position` `baseline_shift`; super/subscript are actually raised/lowered. | Reword: only the *native Parley `BaselineShift` API* is missing, not the effect. |
+| S-4 | memory-audit **Finding 2** "Virtualize page tiles" — *Recommended (not implemented)* (`docs/memory-audit-2026-06-12.md`) | Implemented: `loki-renderer/src/virtualize.rs` `visible_window`; `document_view.rs:290` mounts `PageTile`s only within the viewport window, placeholders elsewhere. | Mark Finding 2 **Fixed**. |
+| S-5 | audit-2026-06-10 **C1** "lists/tables/figures collapse to `HorizontalRule` on first CRDT write" — *Critical open* | `loro_bridge/write.rs:22` writes a native `Block::Table` (and siblings); fidelity gap #1 resolved. | Mark C1 **resolved**. |
+| S-6 | audit-2026-06-10 **S1/S2/S3/S4** (zip-bomb / ODS repeat / ODT attribute amplification / unbounded ODT recursion) — *open* | Mitigated: entry+aggregate caps, `MAX_MATERIALIZED_*`, checked arithmetic, and `MAX_NESTING_DEPTH` guard (`odt/reader/document.rs:22`); audit-2026-06 "Verified mitigations" confirms. | Mark S1–S4 **resolved**. |
+| S-7 | fidelity-audit **gap #14** "horizontal text scale (`w:w`) not applied" — *OPEN* | `loki-layout/src/resolve.rs:390` forwards `.scale` to `StyleSpan`. | Mark gap #14 **resolved**. |
+| S-8 | `CLAUDE.md` Loro round-trip table: "DocumentMeta/DublinCore … export drops the extended Dublin Core fields" | `fidelity-status.md` §1/§9 state metadata now round-trips *and* writes back to DOCX + ODT. (Doc-vs-doc contradiction.) | Reconcile — update the `CLAUDE.md` row to match `fidelity-status.md`. |
+| S-9 | `CLAUDE.md` "worst offenders" ceiling table: `flow.rs` 1612 / `para.rs` 1278 / `odt/reader/styles.rs` 1441 | `file-ceiling-baseline.txt` records `para.rs` 1979 / `flow.rs` 1953 / `styles.rs` 1554 — the files **grew**. The count (35) is right; the sizes are stale. | Regenerate the offenders table from the baseline. |
+
+> **Note on "resolved-as-decision" (Spec 02):** several Spec 02 items are recorded with a "✅ Resolved" *decision* but were never built — **Gelasio font not bundled** (`loki-fonts/fonts/` has no Gelasio face), **vendored schemas absent** (`appthere-conformance/schemas/` = README only, 0 `.xsd`/`.rng`), zero visual goldens, uncalibrated SSIM threshold, and the `vello_cpu` render path (no `vello` dep in the conformance crate). These are decisions awaiting implementation, not completed work — easy to mistake for "done." See §5.
+
+---
+
+## 2. In-code deferrals — `TODO(topic)` (verified still-open)
+
+All are genuine, mostly upstream-gated (Parley/Blitz/Vello) or deliberately deferred UX polish. The stale/partial ones (S-2, S-3) are in §1.
+
+| Topic | file:line(s) | Defers what |
+|---|---|---|
+| `3b-3` (partial) | `navigation.rs` (many) | Cross-page nav: up/down works; **left/right at page edges + `page_index` recompute after split/merge still `None`** |
+| `loro-bridge` | `loro_bridge/inlines.rs:123,220`, `opaque.rs`, `table.rs:25` | Non-Rgb colors (Theme/Cmyk), comment/bookmark anchors, quote/span attrs, structural-table CRDT semantics |
+| `loro-compaction` | `loki-bench/benches/leak_loro_history.rs`; bridge | Compact the CRDT oplog at save/undo-horizon (memory Finding 6) |
+| `omml` | `docx/omml/mod.rs:20` | OMML↔MathML for delimiters, n-ary, matrices, accents |
+| `link-click` | `resolve.rs:689`, `items.rs:125`, `para.rs:203`, `scene.rs:519` | Interactive hyperlink hit-testing (only a visual hint today) |
+| `shadow` | `para_emit.rs:187`, `para.rs:196`, `scene.rs:93` | True soft text shadow (Vello blur) — hard grey offset copy today |
+| `partial-render` | `scene.rs:148`, `editor_pointer.rs:139` | Viewport clipping / direct `node.scroll_offset` |
+| `inline-image-flow` | `resolve.rs:706`, `flow_para.rs:213` | Parley inline image boxes (images prepended block-level today) |
+| `floating-image` | `resolve.rs:705` | Detect "floating" class for inline images (gap #12) |
+| `underline-style` / `strikethrough-style` | `para.rs:164,170` | Double/Dotted/Dash/Wave underline; double strikethrough (all render Single) |
+| `super-sub` (partial) | `para.rs:177,870` | Native Parley `BaselineShift` (effect already applied — see S-3) |
+| `split-optimise` | `para.rs:409` | Y-range item filter to avoid GPU clipping (Option B; Option A shipped) |
+| `tab-default` | `para.rs:648` | Honour `DocumentSettings.default_tab_stop_pt` (hardcoded 36pt) |
+| `spell-baseline` | `para.rs:1619` | Tighten squiggle to run underline offset |
+| `list-picture-bullet` | `para.rs:1795` | Picture bullets (falls back to `•`) |
+| `rotated-cell-editing` | `flow.rs:1676` | Editing data for rotated table cells (read-only today) |
+| `pdf-rotate` | `pdf/src/page.rs:83` | Rotation transform in PDF export |
+| `odf-master-page` | `odf/reader/styles.rs:200` | ODF master-page transitions |
+| `odt-fidelity` | `editor_load.rs:84,88` | Tracked DOCX/ODT import gaps |
+| `formatting` | `editor_formatting.rs:106` | Multi-block-selection formatting (clamped to focus paragraph) |
+| `undo-dirty` | `editor_state.rs:118` | Saved-vs-undo-stack clean tracking (Save not implemented) |
+| `nested-nav` | `navigation.rs:138,174` | Sibling path inside cell/note body |
+| `tabs` | `shell.rs:148`, `home.rs:89` | Tab-driven (vs router) navigation; blank-doc |
+| `ux` | `text/home.rs:266` (+ presentation/spreadsheet) | Confirm-before-delete dialog (delete is immediate) |
+| `browse-templates` / `title-edit` | `text/home.rs:355`, `title_bar.rs:133` | Template browser dialog; inline-editable title |
+| `a11y` | `status_bar.rs` (several) | Expand invisible touch targets to `TOUCH_MIN` |
+| `icons` | `template_gallery.rs:70`, `document_tab.rs:79`, `title_bar.rs:116` | Real illustration / Tabler icon / SVG app icon (emoji placeholders) |
+| `ribbon` / `theme` / `platform` / `font` | various | Ribbon separator variant; **light-theme tokens**; macOS traffic-light region / real OS check; verify bundled UI fonts registered |
+
+---
+
+## 3. External-limitation workarounds — `COMPAT` + dependency patches
+
+### COMPAT clusters (still real unless noted in §1 S-1)
+
+| Cluster / limitation | Reps + count | Still real? |
+|---|---|---|
+| dioxus-native: `position: fixed` collapses to `absolute` | patches note; `button.rs` (1) | Real |
+| dioxus-native: CSS `:hover` → JS `onmouseenter/leave` | `ribbon/button.rs:34` (2) | Real (unconfirmed) |
+| dioxus-native: `white-space:nowrap` / `text-overflow:ellipsis` omitted | tab/title/select (~6) | Real (unconfirmed) |
+| dioxus-native: SVG via Blitz unconfirmed | `icons.rs` (4) | Real (unconfirmed) |
+| dioxus-native: `scrollbar-width/color`, `min-width:0` on flex child | canvas/style (3) | Real (unconfirmed) |
+| dioxus-native: winit drag-region / Taffy definite-height | title/shell (4) | Real |
+| dioxus: `signal.set()` during render | `editor_state.rs:161` (1) | Real |
+| android-mali: Mali-G715 Vulkan device-loss → single-thread init / `use_cpu` / area-AA | `vello_init.rs` (~6) | Real (Mali driver) |
+| android-16: `ANativeActivity_onCreate` fires twice | `android.rs:53` (2) | Real (OS) |
+| microsoft: Word/OOXML file quirks (bookmark ids, dup styleId, missing Normal, `tblW pct`, `vMerge`) | docx mapper (~7) | Real (permanent) |
+| ooxml-dxa / odf: unit + element quirks (twips÷20; ODF column/master-page/self-closing) | reader/mapper (~8) | Real (permanent) |
+| loro / loro-schema: Debug-repr serialization (VerticalAlign, tab_stops) | `editor_formatting.rs:207`, bridge | Real (tech debt — see §6) |
+| parley-0.6 / vello-0.6 / blitz: no geometric H-metrics; Y-up negation; `push_layer` clip-only transform; `Rgba8Unorm` match | layout/vello (~7) | Real (upstream) |
+
+> ~12 further `COMPAT(dioxus-native)` notes document features CLAUDE.md lists as **confirmed working** (`overflow-x/y:auto`, `flex:1`, `calc(100vh-Npx)`, `box-sizing`, `data-*`, `role`) — these are accurate documentation, not workarounds, and need no action.
+
+### Dependency patches (`docs/patches.md`) — all upstream-gated except one
+
+| Patch | Removal condition | Status |
+|---|---|---|
+| `dioxus-native-dom` 0.7.9 | upstream implements non-panicking IME/touch event converters | Gated on upstream — not met |
+| `blitz-shell` 0.2.3 | upstream native `WindowEvent::Touch` forwarding + `UiEvent` touch variants | Gated — not met. (Tooltip sub-note's "supports `position:absolute`" is **partially staled** — absolute works, fixed doesn't.) |
+| `blitz-net` 0.2.1 | upstream ships rustls by default / feature flag | Gated — not met |
+| `dioxus-native` 0.7.9 | upstream calls `request_redraw()` after head-element/event processing | Gated — not met |
+| `blitz-dom` 0.2.4 | upstream: tabindex focus-on-click, scroll dispatch, absolute node-scroll API, static-canvas anim fix | Gated — not met |
+| **`loki-file-access` 0.1.2** | push fixes to the (same-team) `appthere/loki-file-access` repo, publish, repoint | **Actionable locally** — same-team-owned; no evidence pushed. Also needs Gradle `FilePickerActivity.kt`. |
+| ~~`fontique`~~ | — | Already removed 2026-06-21. |
+
+---
+
+## 4. Spec-level deferrals (Spec 01–06)
+
+Verified against code; none silently done-since except the Spec-02 "resolved-as-decision" caveat (§1 note).
+
+| Spec | Deferred item | Verified |
+|---|---|---|
+| 01 | `clippy::pedantic` lint set + allow-list; AST-level `no_hardcoded_layout_dims` dylint; `cargo udeps` dead-`pub` sweep; `editor_save` typed `SaveError`; Android target build verification; 300-line backlog | STILL-OPEN (deliberate residuals) |
+| 02 | `vello_cpu` render path (B-1); vendored ISO 29500/ODF schemas (B-6); zero committed goldens (B-2); uncalibrated SSIM 0.98 (B-3); ΔE/worst-region/heatmap differ (B-4); pinned PDF→PNG rasterizer (B-5); shared `Fixture`/`Consumer` traits (B-8); corpus reorg + ODP/ODG/PPTX importers (B-9); **bundle Gelasio (B-10)**; CI gate wiring (B-11) | STILL-OPEN (several "resolved-as-decision" only) |
+| 03 | Metadata-panel label stacking <250px (R-13g); responsive doc type-scale (M4); real `Viewport.zoom`; ribbon tab-strip touch height (handed to Spec 04) | STILL-OPEN |
+| 04 | **M3 width-driven collapse cascade** (condensed/overflow menu, priority, hysteresis) — unbuilt; **M5 Layout/References/Review tabs + `selected_object` contextual signal** — unbuilt (only 3 non-contextual tabs); M6 touch posture; cursor-into-new-cell after insert | STILL-OPEN (Spec 04 is the least-complete "shipped" spec) |
+| 05 | **Page** family (`page_styles` catalog, ADR-0012); **Table** family (`TableProps` conditional/banding regions); character-style **editing form**; per-family non-paragraph `Default` sources; Compact tree breadcrumb (M7) | STILL-OPEN (model-gated) |
+| 06 | `vello_cpu` render-cost proxy + parity **execution** (BM-3, blocks on Spec 02); GPU frame-time execution (`device` feature); on-device RSS recalibration + macOS/Windows readers (BM-14); Loro compaction; inactive-tab layout retention (BM-8); per-tile font-byte dedup (BM-9) | STILL-OPEN (device-/upstream-gated) |
+
+---
+
+## 5. Prior-audit open findings (memory / perf / security / fidelity)
+
+Still-open after verification (the DONE-SINCE ones moved to §1).
+
+| Source | Item | Verified |
+|---|---|---|
+| memory-audit F3 | Drop preserved layout for inactive tabs (`sessions.rs:39` still retains `Arc<PaginatedLayout>`) | STILL-OPEN |
+| memory-audit F5 | Share render `FontDataCache` (per-tile `page_paint_source.rs:53` vs shared `DocPageSource`) | STILL-OPEN |
+| memory-audit F6 | Compact Loro oplog (`TODO(loro-compaction)`) | STILL-OPEN |
+| audit-2026-06 Q-1 | 300-line ceiling backlog — 43→**35**, CI-ratcheted (PARTIAL; `para.rs`/`flow.rs` grew) | PARTIAL |
+| audit-2026-06 Q-2 | App-shell duplication (per-app `routes/`, `shell.rs`) | PARTIAL |
+| audit-2026-06 Q-3/Q-4 | 301 `let _ =` writer error-swallows (downgraded); ~100 `#[allow]` incl. 32 `dead_code` OOXML | STILL-OPEN (downgraded/P2) |
+| audit-2026-06 P-3/P-5/P-6, S-1b/S-2/S-3/S-5 | Glyph-run scans; coarse cache invalidation; cold-path clones; nested-table drop; dim clamp; UTF-16 odd byte; XXE comment | STILL-OPEN (P2/P3, not re-driven) |
+| audit-2026-06 T-2/T-3/T-5 tails | ODT export impl; per-case DOCX/XLSX round-trips; hard PPTX cases | STILL-OPEN |
+| fidelity gap #12 | External-URL images → grey placeholder (`loki-vello/src/image.rs:34`) | STILL-OPEN |
+| fidelity gap #19 | RTL/bidi direction not forwarded (no Parley bidi API) | STILL-OPEN |
+| fidelity gaps #23,#25,#26,#27,#29,#30 | kerning, orphan/widow, `border_between`, DocxSettings, content controls, language tags | STILL-OPEN |
+| fidelity-status registry | even/odd blank pages; unequal column widths; column height balancing; drop-cap editor fallback; PDF font subsetting; PDF ICC/CMYK; PDF clip/rotate paint; EPUB drops math/fields/comments; ODT `style:default-style`; macOS symbol-bullet fallback; reflow selection-delete + touch select; ACID headless raster + ODP/ODG importers + PPTX fixture; Calc/Slides squiggle rendering; personal-dictionary persistence | STILL-OPEN (registry-tracked) |
+
+> **F1–F7** (audit-2026-06-10 app-layer: presentation tab-switch edit loss, no-op delete/copy, dead retier channels, no Save-As) were **not individually re-driven** this pass — they are app-layer and echoed in the MVP-scope doc §6; treat as likely-open pending a focused check.
+
+---
+
+## 6. Known tech debt (code-confirmed)
+
+| Item | Status |
+|---|---|
+| 300-line-ceiling backlog | **35** baselined files; CI-ratcheted so it can only shrink. `CLAUDE.md`'s worst-offenders sizes are stale (see S-9). |
+| `tab_stops` Loro round-trip | STILL-OPEN — written as Debug string (`loro_bridge/write.rs:187`), no reader in `props_read.rs`. |
+| paragraph `background_color` Loro round-trip | STILL-OPEN — Debug string (`write.rs:190`); the only reader (`props_read.rs:273`) uses `from_hex` and cannot parse it. |
+| `DocumentMeta`/DublinCore export | **DONE** (writes back to DOCX/ODT) — `CLAUDE.md` row is stale (see S-8). |
+| CRDT bridge stubs | `BulletList`/`OrderedList`/`Figure`/`BlockQuote`/`Div` are debug-log-only in the bridge (export still works from the Document snapshot). |
+
+---
+
+## 7. Out-of-MVP scope (Loki Calc / Loki Slides)
+
+From `docs/mvp-scope-spreadsheet-presentation-2026-06-13.md` — deliberately post-MVP, not defects:
+
+- **Calc:** dead ribbon chrome (tab-select/collapse/zoom are no-ops); row/col virtualization above 500×52; richer formulas (COUNTIF/ROUND/text/comparison, string/bool types); type-to-edit; Shift+Arrow range select. Out of scope: charts, multi-sheet tab UI, frozen panes, cell comments, conditional formatting, find/replace, copy/paste, row/col resize+insert/delete.
+- **Slides:** PPTX image/group export; real masters/layouts/theme derivation; ODP import; run-level formatting; shape add/move/resize + Loro undo; faithful per-shape layout (HTML/CSS flow for MVP, no pixel-exact placement); known bugs (in-memory edits lost on tab switch, dead ribbon/zoom handlers).
+- **Cross-cutting:** both apps bypass `loki-i18n` for many strings and have **0 tests**.
+
+---
+
+## 8. Recommended actions (from §1) — ✅ applied 2026-07-04
+
+Pure documentation hygiene — no functional change, but stops the docs from misdirecting future work. **All items below were applied in the same pass** (comment rewrites + status-marker corrections; no behaviour changed):
+
+1. Update the four stale **memory/audit/fidelity** statuses: memory Finding 2 → Fixed (S-4); audit-2026-06-10 C1 (S-5) and S1–S4 (S-6) → resolved; fidelity gap #14 → resolved (S-7).
+2. Remove/rewrite the stale **in-code** notes: `TODO(editing)` (S-2), `TODO(super-sub)` wording (S-3), and the ~5 `COMPAT(dioxus-native): position:absolute` notes (S-1).
+3. Reconcile the two **`CLAUDE.md`** rows: DublinCore export (S-8) and the worst-offenders ceiling sizes (S-9).
+4. Reclassify the Spec 02 **"resolved-as-decision"** items (Gelasio, schemas, goldens, SSIM, `vello_cpu`) so they read as *decided, not built*.
+
+Everything else in §2–§7 is a genuine, correctly-documented deferral.
diff --git a/docs/fidelity-audit-2026-04-20.md b/docs/fidelity-audit-2026-04-20.md
index 0291008d..2c0cacec 100644
--- a/docs/fidelity-audit-2026-04-20.md
+++ b/docs/fidelity-audit-2026-04-20.md
@@ -46,7 +46,7 @@ Root-cause layers: **A** OOXML/ODF mapper · **B** loki-doc-model missing field
 | 11 | Inline elements | **Hyperlink URLs lost.** `walk_inlines` extracts the text content of `Inline::Link` but discards the URL. Links render as unstyled plain text. | P1 | C | `loki-layout/src/resolve.rs:213–216` | **[RESOLVED]** |
 | 12 | Images | **External URL images render as grey placeholder.** `paint_image` only decodes `data:` URIs; any `http://`, `https://`, or `file://` `src` receives a `FilledRect` grey box. Intentional for v0.1 but still a visible gap. | P1 | D | `loki-vello/src/image.rs:34–42` | **[OPEN]** |
 | 13 | Typography | **Letter spacing not applied.** `CharProps.letter_spacing` is mapped from `w:spacing` (twips → points, props.rs:189) but never reaches `StyleSpan` or Parley. | P2 | C | `loki-layout/src/resolve.rs:143–155` | **[RESOLVED]** |
-| 14 | Typography | **Horizontal text scale not applied.** `CharProps.scale` is mapped from `w:w` (percentage, props.rs:192) but never reaches `StyleSpan` or Parley. | P2 | C | `loki-layout/src/resolve.rs:143–155` | **[OPEN]** |
+| 14 | Typography | **Horizontal text scale.** `CharProps.scale` (mapped from `w:w`, props.rs:192) now reaches `StyleSpan.scale` — a non-trivial positive scale is forwarded to Parley. | P2 | C | `loki-layout/src/resolve.rs:387–390` | **[RESOLVED 2026-07-04]** |
 | 15 | Typography | **Small caps not applied.** `CharProps.small_caps` is parsed (props.rs:150) but absent from `StyleSpan`. | P2 | C | `loki-layout/src/resolve.rs:143–155` | **[RESOLVED]** |
 | 16 | Typography | **All caps not applied.** `CharProps.all_caps` is parsed (props.rs:151) but absent from `StyleSpan`. | P2 | C | `loki-layout/src/resolve.rs:143–155` | **[RESOLVED]** |
 | 17 | Typography | **Underline style variety collapsed to single.** `UnderlineStyle` enum (Single / Double / Dotted / Dash / Wave / Thick) is fully parsed and stored, but `StyleSpan.underline` is a `bool`. All underline variants render identically. | P2 | C | `loki-layout/src/para.rs:50` (`StyleSpan`); `loki-layout/src/resolve.rs:152` (mapping) | **[RESOLVED]** |
diff --git a/docs/fidelity-status.md b/docs/fidelity-status.md
index cf8e9d36..fc472022 100644
--- a/docs/fidelity-status.md
+++ b/docs/fidelity-status.md
@@ -13,7 +13,7 @@ This is the living source of truth documenting which document features, characte
 | **Document Metadata** | Yes | — | Yes | Core properties (title, subject, keywords, description, creator, last-modified-by, created/modified dates, language, revision) round-trip in both formats — DOCX via `docProps/core.xml` (OPC `CoreProperties`; the `serde` feature on `loki-opc` is enabled so the reader/writer are real, not stubs), ODT via `meta.xml`. **Extended Dublin Core** (publisher, contributors, rights, license, identifier, identifier-scheme, type, format, source, relation, coverage, issued, bibliographic-citation) round-trips too: `dc:identifier` uses the native core.xml element; the rest are carried as DOCX `docProps/custom.xml` custom properties / ODT `meta:user-defined` entries under reserved `dcmi:` names. The flattening is shared via `DublinCoreMeta::to_named_pairs`/`from_named_pairs` in `loki-doc-model`. Tested by `metadata_round_trip.rs` (DOCX) and `extended_dublin_core_round_trips` (ODT). Not yet written: custom user properties, `meta:editing-duration`, OOXML `docProps/app.xml`. |
 | **Multi-column Sections** | Yes | Yes | Yes | Column count, gap, and separator line round-trip in both formats — DOCX `w:cols` (`@w:num`/`@w:space`/`@w:sep`) and ODF `style:columns` (`fo:column-count`/`fo:column-gap` + `style:column-sep`). At **layout time** (paginated mode) the flow engine divides the content area into equal columns and fills each top-to-bottom before advancing to the next column and then the page (`flow_columns.rs`); the requested separator line is drawn between used columns. Continuous/reflow modes ignore columns by design. Tested by `export_columns.rs` / `multi_column_section_round_trips` (round-trip) and `text_flows_down_columns_before_paging` / `column_separator_line_is_drawn` (layout). Known limitations: columns are balanced only implicitly (fill-first, no height balancing), and footnotes still flow in the last active column. |
 | **Headers & Footers** | Yes | Yes | Yes | DOCX export writes all three variants — default, first-page (`w:titlePg`), and even-page (`word/settings.xml` with `w:evenAndOddHeaders`) — as `w:hdr`/`w:ftr` parts with full block content; ODT export writes them into the master page. Round-trip tested (`even_page_headers_footers_round_trip`). |
-| **Footnotes & Endnotes** | Yes | Yes | Yes | Rendered at end of section with separator rules. |
+| **Footnotes & Endnotes** | Yes | Yes | Yes | Rendered at end of section with separator rules. **DOCX export** writes the reference marker as a `<w:rStyle>` to the always-emitted `FootnoteReference`/`EndnoteReference` character style (which carries the superscript), matching Word — *not* as an explicit `<w:vertAlign>` on the marker run, which would add a direct run property the source model never had and break round-trip stability. Verified by the Spec 02 import-export-import guard `docx_reference_round_trip_is_stable`. |
 | **Dynamic Fields** | Yes | Partial | Yes | Import reads **both** field encodings: complex fields (`w:fldChar`/`w:instrText` state machine) and the compact `w:fldSimple` form (`@w:instr` + cached-result runs, including the self-closing variant) — both map to an identical `Inline::Field` (`fld_simple.rs`). Export writes body-text fields as complex fields (with `separate`+result when a snapshot is cached) — PAGE, NUMPAGES, DATE/TIME (incl. `\@` format switch), TITLE, AUTHOR, SUBJECT, FILENAME, NUMWORDS, REF/PAGEREF cross-references, and `Raw` instructions round-trip (`export_fields.rs`). PAGE / NUMPAGES in headers & footers render real per-page values (per-page re-layout in `assign_headers_footers`); body-text fields still *render* snapshots (post-layout computation, ADR-0008, is proposed). |
 | **Line-boundary Splitting** | — | Yes | — | Paragraphs split cleanly across pages using `ClippedGroup` masks. |
 | **keep-together** | Yes | Yes | Yes | Prevents paragraph line breaks across pages when enabled. |
@@ -24,7 +24,7 @@ This is the living source of truth documenting which document features, characte
 | **Math (equations)** | Yes | Partial | Yes | Mathematical equations round-trip through both formats. The format-neutral model stores math as a single MathML `<math>` string in `Inline::Math` (the W3C interchange standard and ODF's native form). **DOCX** converts bidirectionally between OMML (`m:oMath` inline / `m:oMathPara` display) and MathML in `loki-ooxml`'s `docx/omml` module; the converter is mutually inverse over the common construct set — text runs (`m:r`/`m:t` ⇄ `<mi>`/`<mn>`/`<mo>`), fractions (`m:f`), super/subscripts (`m:sSup`/`m:sSub`/`m:sSubSup`), and radicals (`m:rad` ⇄ `<msqrt>`/`<mroot>`). **ODT** embeds the MathML as a formula sub-document (`draw:frame`/`draw:object` → `Object N/content.xml`, listed in the manifest with the `…opendocument.formula` media type) and reads it back, canonicalising on import (`loki-odf`'s `odt::math`); ODF does not distinguish display from inline math, so embedded formulas map to `MathType::InlineMath`. **Persisted through the Loro CRDT** losslessly: a block containing math is preserved as an opaque snapshot. **Rendered** by a first-pass math typesetter (`loki-layout`'s `math` module): the MathML is laid out into positioned glyph runs (tokens shaped via Parley) plus fraction-bar/radical rules, then placed inline via a Parley inline box (the same mechanism as tab stops). Covers identifiers/numbers/operators, rows, fractions (`mfrac`), scripts (`msup`/`msub`/`msubsup`), radicals (`msqrt`/`mroot`), and fenced expressions (`mfenced` / fence-wrapped rows) — reusing the standard `PositionedItem` glyph/rect types so `loki-vello` paints it with no renderer change. **The equation's baseline is aligned to the text baseline** (the inline box reserves the equation's ascent; Parley aligns box bottoms to the baseline, so the descent hangs below into the line like inline text, and the paragraph height grows to cover a deep denominator). **Radical signs and delimiters stretch to their content** via uniform glyph scaling. **Math is set in a serif/math face** (`FontFamily::Source("Cambria Math, STIX Two Math, Latin Modern Math, serif")` in the token shaper) rather than the sans-serif body default, matching Word's Cambria Math. **A paragraph that is solely an equation is centered** (display math): Word renders both `m:oMathPara` and a bare paragraph-level `m:oMath` as a centered display equation, so the DOCX mapper centers a paragraph whose only content (ignoring whitespace) is math when it has no explicit alignment. Tested by `omml_tests` + `math_round_trip.rs` (DOCX), `math_tests` + `math_round_trip.rs` (ODT), the `math::tests` typesetter unit tests (incl. stretch), and `inline_math_emits_typeset_items` / `inline_math_baseline_aligns_with_text` (layout integration). **Approximations / not yet done:** stretchy glyphs widen as they grow (uniform scaling, not true extensible glyphs); inter-atom spacing follows simple proportional gaps rather than the full TeX `mathspacing` table; matrices/n-ary operators/accents are not laid out. The OMML↔MathML converter likewise does not yet cover delimiters, n-ary operators, matrices, or accents (these pass through best-effort), so delimiter rendering currently applies to MathML that already contains fences (e.g. ODT-imported or hand-authored), not DOCX OMML round-trips. |
 | **Templates (DOTX / OTT)** | Yes | — | Partial | Office `.dotx`/`.dotm` and LibreOffice `.ott` open as new untitled documents (the importers key off the `officeDocument` relationship / accepted template mimetype). Export: **Save as Template** writes `.dotx` (template content type) via `DocxTemplateExport`. Five templates (Markdown, APA, MLA, Screenplay, Resume) ship as bundled `.dotx` assets (`loki-templates`) and open from the home gallery. |
 | **ODT export** | Yes | — | Yes | `loki-odf`'s `OdtExport` writes a full ODT package (`content.xml` / `styles.xml` / `meta.xml` + `Pictures/`). **Lossless** for: the complete character-property set (fonts incl. complex/East-Asian, size, weight, italic, underline, strike, caps, outline, shadow, super/sub, colour, letter/word spacing, kerning, scale, languages), the complete paragraph-property set (alignment, indents, spacing, line height, keep/widow/orphan/break flags, borders, padding, tab stops, bidi, background), the named style catalog, **multi-section page geometry** (each section gets its own `style:page-layout` + `style:master-page`; section breaks are emitted as `style:master-page-name` on the first paragraph of each section, the form the importer reads back), **headers/footers** (default/first/even, written per-section into the master page with their own automatic styles + images), headings, styled paragraphs, lists, tables, footnotes/endnotes, links, **bookmarks, fields, and embedded images** (decoded from data URIs and written as `Pictures/` parts), and core Dublin Core metadata. A property-level round-trip test asserts each survives. Editing an opened `.odt` and saving round-trips to ODT. **Multi-column sections** (`style:columns` with count/gap/separator), **extended Dublin Core** (publisher, contributors, rights, license, identifier, type, format, source, relation, coverage, issued, citation — carried as `meta:user-defined` entries under reserved `dcmi:` names), and **comments** (`office:annotation` / `office:annotation-end`) also round-trip. **Math** is emitted as embedded formula objects (`draw:object` → `Object N/content.xml` MathML, listed in the manifest). Still not emitted: the OTT template content type. |
-| **Reflow (non-paginated) view** | — | Yes | — | `LayoutMode::Reflow` + `RenderMode::Reflow` render a continuous web-style flow through the same layout/Vello pipeline as paginated view (full font/size/alignment fidelity), sliced into zero-gap GPU band tiles (768pt ⇒ exact 1024 CSS px, so tiles stack seamlessly). Relayouts to the window width on resize (shell re-emits `onscroll` for scroll containers). Content wider than the viewport (e.g. a fixed-width table) widens the tiles so it is reachable by horizontal scrolling rather than clipped. No headers/footers/page chrome by design; the status-bar page indicator is hidden in reflow. **Editing:** `ContinuousLayout` carries per-paragraph editing data, so click-to-cursor, caret placement/painting, range-selection highlighting (mouse drag-select + Shift+Arrow), and reflow-native arrow / Home / End navigation all work, plus typing/undo/formatting. Still missing: typing/Backspace over a selection does not yet delete the selected range first (it inserts at the focus), and touch long-press selection is not wired for reflow. Android CPU builds (no `android_gpu`) fall back to a low-fidelity HTML flow (`reflow_view.rs`) with no caret. |
+| **Reflow (non-paginated) view** | — | Yes | — | `LayoutMode::Reflow` + `RenderMode::Reflow` render a continuous web-style flow through the same layout/Vello pipeline as paginated view (full font/size/alignment fidelity), sliced into zero-gap GPU band tiles (768pt ⇒ exact 1024 CSS px, so tiles stack seamlessly). Relayouts to the window width on resize (shell re-emits `onscroll` for scroll containers). **Bounded reading measure (Spec 03 M4):** the reflow tile is capped at `MAX_REFLOW_TILE_PX` (820 CSS px) and centred (`margin: auto`) on wide windows, so the line length stays comfortable instead of running edge-to-edge; narrow screens still use their full width. A single `render_layout::{reflow_tile_width_px, reflow_content_width_pt}` feeds paint, hit-test, and keyboard nav so they stay aligned (the HTML fallback references the same constant). Content wider than the viewport (e.g. a fixed-width table) widens the tiles so it is reachable by horizontal scrolling rather than clipped. No headers/footers/page chrome by design; the status-bar page indicator is hidden in reflow. **Editing:** `ContinuousLayout` carries per-paragraph editing data, so click-to-cursor, caret placement/painting, range-selection highlighting (mouse drag-select + Shift+Arrow), and reflow-native arrow / Home / End navigation all work, plus typing/undo/formatting. Still missing: typing/Backspace over a selection does not yet delete the selected range first (it inserts at the focus), and touch long-press selection is not wired for reflow. Android CPU builds (no `android_gpu`) fall back to a low-fidelity HTML flow (`reflow_view.rs`) with no caret. |
 
 ---
 
@@ -39,12 +39,12 @@ This is the living source of truth documenting which document features, characte
 | **Font Family / Size** | Yes | Yes | Yes | Resolves against style catalog and font resources. |
 | **Vertical Alignment** | Yes | Yes | Yes | Superscript and subscript (`w:vertAlign` / `style:text-position`) — font reduced to 58 % and the run shifted above/below the baseline. **Manual baseline shift / text rise** (`w:position`, in half-points; `style:text-position` vertical component) is also supported (`CharProps.baseline_shift` → `StyleSpan.baseline_shift`): the glyphs are raised/lowered *without* shrinking, applied **per glyph** at emit time. This per-glyph application (and the same for horizontal scale, below) makes both robust to Parley coalescing adjacent same-font runs into one glyph run — a run carrying only a different rise/scale (attributes Parley does not track) would otherwise be missed by a per-run lookup, so the ACID page-14 `raised`/`lowered`/`scaled150` runs previously rendered flat/unscaled. Tested by `coalesced_scale_and_baseline_shift_apply_per_glyph` (layout) and `position_maps_to_baseline_shift_in_points` (DOCX mapper). Not re-exported. |
 | **Color** | Yes | Yes | Yes | Linear sRGB, transparent, and fallback mappings. |
-| **Highlight Color** | Yes | Yes | Yes | Run highlight (`w:highlight` → 16-colour palette) and run shading (`w:shd @fill` / `fo:background-color`, folded into the same `StyleSpan.highlight_color`) render as a filled underlay behind the text. **Robust to Parley run coalescing:** the underlay is emitted from a Parley **selection-geometry pass** over each highlighted span's byte range (`layout_paragraph`), not from the per-glyph-run lookup — so a highlighted run that Parley shaped into one glyph run together with an adjacent same-font/colour run (highlight is not a Parley style) still paints. (The earlier per-run lookup required a single span to fully contain the shaped run and silently dropped the highlight whenever runs coalesced — e.g. the ACID `highlight=yellow` + `shd run-fill` paragraph showed nothing.) The banded drop-cap/float path keeps the per-run underlay. Tested by `highlight_color_produces_filled_rect_before_glyph_run` and `highlight_emits_even_when_runs_coalesce`. |
-| **Letter Spacing** | Yes | Yes | Yes | Mapped to Parley letter spacing. |
+| **Highlight Color** | Yes | Yes | Yes | Run highlight (`w:highlight` → 16-colour palette) and run shading (`w:shd @fill` / `fo:background-color`, folded into the same `StyleSpan.highlight_color`) render as a filled underlay behind the text. **Robust to Parley run coalescing:** the underlay is emitted from a Parley **selection-geometry pass** over each highlighted span's byte range (`layout_paragraph`), not from the per-glyph-run lookup — so a highlighted run that Parley shaped into one glyph run together with an adjacent same-font/colour run (highlight is not a Parley style) still paints. (The earlier per-run lookup required a single span to fully contain the shaped run and silently dropped the highlight whenever runs coalesced — e.g. the ACID `highlight=yellow` + `shd run-fill` paragraph showed nothing.) The banded drop-cap/float path keeps the per-run underlay. Tested by `highlight_color_produces_filled_rect_before_glyph_run` and `highlight_emits_even_when_runs_coalesce`. **DOCX export** now writes `w:highlight` for a direct run property (`emit_char_props`); previously only ODT export emitted it, so a DOCX-exported run carrying *only* a highlight lost it and collapsed to a plain run. Surfaced by the Spec 02 import-export-import conformance harness (`conformance_round_trip.rs`) and locked by `run_props` unit tests. |
+| **Letter Spacing** | Yes | Yes | Yes | Mapped to Parley letter spacing. **DOCX export** now writes `w:spacing` (twips) for a direct run property (`emit_char_props`); previously DOCX export dropped it (ODT export already round-tripped it). Surfaced by the Spec 02 import-export-import conformance harness. |
 | **Word Spacing** | Yes | Yes | Yes | Mapped to Parley word spacing. |
-| **Small Caps / All Caps** | Yes | Yes | Yes | Both are **synthesized** during `flatten_paragraph` (resolve.rs), since Parley exposes no `FontVariantCaps`. **All caps:** the run text is uppercased. **Small caps:** the text is uppercased *and* the letters that were lowercase in the source are split into their own spans at a reduced size (`SMALL_CAPS_RATIO` = 0.8 of the cap size), so capitals stay full height while former-lowercase letters render as small capitals — the real small-caps look. (Previously `small_caps` only set an unused `StyleSpan.font_variant` flag, so small-caps text rendered at full size, indistinguishable from normal.) Tested by `flatten_all_caps_uppercases_text` and `flatten_small_caps_uppercases_and_shrinks_lowercase`. |
+| **Small Caps / All Caps** | Yes | Yes | Yes | Both are **synthesized** during `flatten_paragraph` (resolve.rs), since Parley exposes no `FontVariantCaps`. **All caps:** the run text is uppercased. **Small caps:** the text is uppercased *and* the letters that were lowercase in the source are split into their own spans at a reduced size (`SMALL_CAPS_RATIO` = 0.8 of the cap size), so capitals stay full height while former-lowercase letters render as small capitals — the real small-caps look. (Previously `small_caps` only set an unused `StyleSpan.font_variant` flag, so small-caps text rendered at full size, indistinguishable from normal.) Tested by `flatten_all_caps_uppercases_text` and `flatten_small_caps_uppercases_and_shrinks_lowercase`. **DOCX export** now writes `w:caps` for all-caps direct run properties (`emit_char_props`; small-caps `w:smallCaps` was already emitted); previously all-caps was dropped on DOCX export (ODT export already round-tripped it). Surfaced by the Spec 02 conformance harness. |
 | **Shadow Text** | Yes | Yes | Yes | Mapped to StyleSpan properties. |
-| **Horizontal Scale (`w:w`)** | Yes | Yes | Yes | `CharProps.scale` reaches `StyleSpan.scale` and is applied geometrically to glyph advances/positions and highlight/decoration widths in `emit_glyph_run`, anchored at the run's left edge; later runs on the line are shifted by the added width (now returned from `emit_glyph_run`) so they do not overlap. **Applied per glyph** via each glyph's cluster→span mapping, so a scaled run that Parley shaped together with an un-scaled neighbour (same font/colour) still stretches only its own glyphs — see the baseline-shift row for the coalescing rationale. COMPAT(parley): Parley has no geometric horizontal scale, so line-breaking still measures the unscaled run — a scaled run can extend past the right margin where Word would have wrapped earlier (gap #14). Tested by `horizontal_scale_widens_glyph_advances` and `coalesced_scale_and_baseline_shift_apply_per_glyph`. |
+| **Horizontal Scale (`w:w`)** | Yes | Yes | Yes | `CharProps.scale` reaches `StyleSpan.scale` and is applied geometrically to glyph advances/positions and highlight/decoration widths in `emit_glyph_run`, anchored at the run's left edge; later runs on the line are shifted by the added width (now returned from `emit_glyph_run`) so they do not overlap. **Applied per glyph** via each glyph's cluster→span mapping, so a scaled run that Parley shaped together with an un-scaled neighbour (same font/colour) still stretches only its own glyphs — see the baseline-shift row for the coalescing rationale. COMPAT(parley): Parley has no geometric horizontal scale, so line-breaking still measures the unscaled run — a scaled run can extend past the right margin where Word would have wrapped earlier (gap #14). Tested by `horizontal_scale_widens_glyph_advances` and `coalesced_scale_and_baseline_shift_apply_per_glyph`. **DOCX export** now writes `w:w` (integer percent) for a direct run property (`emit_char_props`); previously DOCX export dropped it (ODT export already round-tripped it). The same `emit_char_props` pass also restores DOCX export of `w:shadow`, `w:kern`, `w:szCs`, the complex/East-Asian `w:rFonts` faces, run `w:shd` background, and `w:lang` — every direct run property the importer reads is now written back, keeping DOCX export symmetric with import. Surfaced by the Spec 02 conformance harness. |
 | **Kerning** | Yes | No | No | Kerning flag dropped at layout time (gap #23). |
 | **Language Tags** | Yes | No | No | No locale-sensitive shaping or hyphenation. |
 
diff --git a/docs/memory-audit-2026-06-12.md b/docs/memory-audit-2026-06-12.md
index 8eebb1d7..473c4e5a 100644
--- a/docs/memory-audit-2026-06-12.md
+++ b/docs/memory-audit-2026-06-12.md
@@ -12,7 +12,7 @@ identified here are independent of that.
 | # | Finding | Severity | Status |
 |---|---------|----------|--------|
 | 1 | Page tiles default to **Hot tier** and only demote on scroll-settle, so an opened-but-unscrolled document keeps a full-resolution texture per page | **Critical** | **Fixed** |
-| 2 | No page virtualization — every page is a mounted tile holding a texture | High | Recommended |
+| 2 | No page virtualization — every page is a mounted tile holding a texture | High | **Fixed** (`virtualize.rs` `visible_window`; `document_view.rs` mounts tiles only near the viewport, placeholders elsewhere) |
 | 3 | Inactive-tab sessions retain the full preserved layout (+ Loro + undo) | Medium | Recommended |
 | 4 | Paragraph shaping cache accumulated across documents; generous cap | Medium | **Fixed** |
 | 5 | Per-tile `FontDataCache` duplicates interned font bytes across tiles | Low | Recommended |
@@ -79,12 +79,13 @@ the editor's layout — see the single-canonical-layout change).
 These need the GPU/app running to validate, so they are written up rather than
 applied blind.
 
-- **Finding 2 — Virtualize page tiles.** `DocumentView` mounts a `PageTile`
-  for *every* page (`for (idx, w, h) in pages` over `0..page_count`). Even Cold,
-  each tile keeps a ~0.75 MB texture, a `FontDataCache`, and component state.
-  Render only the tiles within (hot ∪ warm ∪ a margin) of the viewport and mount
-  lightweight placeholders elsewhere. With Finding 1 fixed the per-tile cost is
-  already much lower, but this removes it for off-screen pages entirely.
+- **Finding 2 — Virtualize page tiles. ✅ FIXED (verified 2026-07-04).** The
+  recommendation below was implemented: `loki-renderer/src/virtualize.rs`
+  (`visible_window`) restricts mounted `PageTile`s to the viewport neighbourhood,
+  and `document_view.rs` mounts lightweight placeholders elsewhere. *Original
+  recommendation:* `DocumentView` mounted a `PageTile` for *every* page; even Cold,
+  each tile kept a ~0.75 MB texture, a `FontDataCache`, and component state — so
+  render only the tiles within (hot ∪ warm ∪ a margin) of the viewport.
 
 - **Finding 3 — Drop preserved layouts for inactive tabs.** `DocSession`
   stashes `paginated_layout: Arc<PaginatedLayout>` for every inactive tab. With
diff --git a/iris.png b/iris.png
deleted file mode 100644
index 95f9a810..00000000
Binary files a/iris.png and /dev/null differ
diff --git a/iris_output.png b/iris_output.png
deleted file mode 100644
index 1be226e5..00000000
Binary files a/iris_output.png and /dev/null differ
diff --git a/iris_stderr.log b/iris_stderr.log
deleted file mode 100644
index a73e7e54..00000000
Binary files a/iris_stderr.log and /dev/null differ
diff --git a/loki-app-shell/src/android.rs b/loki-app-shell/src/android.rs
new file mode 100644
index 00000000..6eb825e7
--- /dev/null
+++ b/loki-app-shell/src/android.rs
@@ -0,0 +1,129 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Shared Android `NativeActivity` entry point for the Loki suite binaries.
+//!
+//! Each binary (`loki-text`, `loki-spreadsheet`, `loki-presentation`) is an
+//! independent `cdylib` and must export its own `android_main` symbol, so the
+//! entry point can't be a plain function in this crate. The bootstrap *body*,
+//! however, was duplicated verbatim across all three (Spec 01 audit A-14): the
+//! Android-16 double-fire guard, logger + panic-to-logcat setup, file-access
+//! init, safe-area insets, `set_android_app`, i18n, and the Dioxus launch.
+//!
+//! [`android_main!`] generates that body once. It is a macro rather than a
+//! function so the expansion uses each binary's own `dioxus` / `blitz_shell` /
+//! `android_activity` dependencies — keeping this crate lean and
+//! `#![forbid(unsafe_code)]` (the emitted `unsafe` lives in the *caller*, under
+//! the scoped `#[allow(unsafe_code)]` the macro attaches; Spec 01 audit A-7).
+//!
+//! ## Usage
+//!
+//! ```ignore
+//! // in each binary's lib.rs, with `#![deny(unsafe_code)]` at the crate root:
+//! loki_app_shell::android_main!(tag = "LOKI-SHEET", root = app::App, file_access = activity_ptr);
+//! ```
+//!
+//! `file_access = activity_ptr` passes `android_app.activity_as_ptr()` to
+//! `loki_file_access::init_android`; `file_access = null_context` passes a null
+//! pointer (the call is a no-op kept for API compatibility — the JNI
+//! `Application` context comes from `ndk_context`, which `android-activity`
+//! initialises before `android_main` runs).
+
+/// Generates a binary's Android `android_main` FFI entry point. See the
+/// [module docs](self) for usage and the `file_access` modes.
+#[macro_export]
+macro_rules! android_main {
+    (tag = $tag:literal, root = $root:path, file_access = activity_ptr) => {
+        $crate::android_main!(@impl $tag, $root, {
+            // SAFETY: activity_as_ptr() is a GlobalRef owned by android_app, which
+            // blitz_shell::set_android_app keeps alive for the process lifetime.
+            unsafe { ::loki_file_access::init_android(android_app.activity_as_ptr()) }
+        });
+    };
+    (tag = $tag:literal, root = $root:path, file_access = null_context) => {
+        $crate::android_main!(@impl $tag, $root, {
+            // init_android is a no-op kept for API compatibility; the Application
+            // context used by all JNI calls comes from ndk_context, which
+            // android-activity initialises before android_main is called.
+            unsafe { ::loki_file_access::init_android(::core::ptr::null_mut()) }
+        });
+    };
+    (@impl $tag:literal, $root:path, $init_file_access:block) => {
+        #[cfg(target_os = "android")]
+        // COMPAT(android-16): On Android 16 (API 36) ANativeActivity_onCreate fires
+        // twice in rapid succession, spawning two concurrent android_main threads.
+        // A static OnceLock would also block legitimate activity-recreation relaunches
+        // within the same process (process reuse), so use a Mutex<bool> "is-running"
+        // flag instead: set on entry, cleared on exit, so concurrent duplicates are
+        // rejected while sequential re-entries (activity destroyed → recreated) succeed.
+        static ANDROID_MAIN_RUNNING: ::std::sync::Mutex<bool> = ::std::sync::Mutex::new(false);
+
+        #[cfg(target_os = "android")]
+        #[unsafe(no_mangle)]
+        // FFI entry point: the `#[unsafe(no_mangle)]` attribute and the
+        // `init_android` call below are the only `unsafe` in this binary. The
+        // crate root is `#![deny(unsafe_code)]`; this scopes the exception to the
+        // entry point alone (Spec 01 audit A-7).
+        #[allow(unsafe_code)]
+        fn android_main(android_app: ::android_activity::AndroidApp) {
+            {
+                let mut running = ANDROID_MAIN_RUNNING
+                    .lock()
+                    .unwrap_or_else(|p| p.into_inner());
+                if *running {
+                    // Concurrent duplicate invocation on Android 16 — discard it.
+                    return;
+                }
+                *running = true;
+            }
+            ::android_logger::init_once(
+                ::android_logger::Config::default()
+                    .with_tag($tag)
+                    .with_max_level(::log::LevelFilter::Debug),
+            );
+            // Route panic messages to logcat. The default panic hook writes to
+            // stderr, which Android discards — without this, any Rust panic (e.g.
+            // during GPU renderer init) is indistinguishable from a native crash.
+            ::std::panic::set_hook(::std::boxed::Box::new(|info| {
+                ::log::error!("PANIC: {info}");
+            }));
+            ::log::info!("android_main: start");
+            $init_file_access;
+            let (top, bottom) = ::loki_file_access::query_insets_dp();
+            ::log::info!("android_main: safe area insets top={top} bottom={bottom}");
+            ::appthere_ui::set_safe_area_insets(::appthere_ui::SafeAreaInsets {
+                top,
+                bottom,
+                ..::core::default::Default::default()
+            });
+            // Store the internal data path before android_app is moved, so that
+            // recent_documents can persist to a writable location on Android.
+            if let Some(data_path) = android_app.internal_data_path() {
+                $crate::recent_documents::set_android_data_dir(data_path);
+            }
+            ::blitz_shell::set_android_app(android_app);
+            ::log::info!("android_main: i18n init");
+            ::loki_i18n::init();
+            ::log::info!("android_main: launching dioxus");
+            // Register the bundled UI + metric-compatible fonts directly into the
+            // renderer's font collection at startup, so they resolve synchronously
+            // on Android instead of relying on the asynchronous `@font-face`
+            // `data:` URI fetch (which does not reliably run before first paint on
+            // Android, leaving UI chrome digits in a wide system fallback). See
+            // `loki_fonts::ui_font_blobs`.
+            ::dioxus::native::launch_cfg(
+                $root,
+                ::std::vec![],
+                ::std::vec![::std::boxed::Box::new(
+                    ::dioxus::native::Config::new().with_fonts(::loki_fonts::ui_font_blobs()),
+                )],
+            );
+            ::log::info!("android_main: dioxus exited");
+            // Clear the running flag so a subsequent activity-recreation relaunch
+            // (in the same process) is allowed to proceed.
+            *ANDROID_MAIN_RUNNING
+                .lock()
+                .unwrap_or_else(|p| p.into_inner()) = false;
+        }
+    };
+}
diff --git a/loki-app-shell/src/lib.rs b/loki-app-shell/src/lib.rs
index 8f99390e..5bddedce 100644
--- a/loki-app-shell/src/lib.rs
+++ b/loki-app-shell/src/lib.rs
@@ -17,6 +17,11 @@
 
 #![forbid(unsafe_code)]
 
+// The shared Android entry-point macro. `#[macro_export]` hoists `android_main!`
+// to the crate root (`loki_app_shell::android_main!`). The macro body's `unsafe`
+// tokens are emitted into the *caller*, so this crate stays `forbid(unsafe_code)`.
+mod android;
+
 pub mod new_document;
 pub mod recent_documents;
 pub mod spell;
diff --git a/loki-bench/Cargo.toml b/loki-bench/Cargo.toml
new file mode 100644
index 00000000..23b0317a
--- /dev/null
+++ b/loki-bench/Cargo.toml
@@ -0,0 +1,94 @@
+[package]
+name = "loki-bench"
+version = "0.1.0"
+edition = "2024"
+license = "Apache-2.0"
+description = "Shared benchmarking & continuous-memory-tracking harness for the AppThere Loki suite — Spec 06. Sorts every bench onto one of two axes: portable (headless: allocation bytes/counts, op cost) and device-bound (GPU frame-time, peak RSS; hardware-only)."
+repository = "https://github.com/appthere/loki"
+keywords = ["benchmarking", "memory", "profiling", "loki"]
+categories = ["development-tools::profiling"]
+
+[features]
+default = []
+# Marks the device-bound axis (GPU frame-time, real peak RSS). Off by default so
+# the portable set builds and runs headless in the agent environment with no GPU
+# — the device benches are hardware-only (Spec 06 §5). The GPU/RSS measurement
+# itself lands in Spec 06 M5; this feature only gates the axis today.
+device = []
+
+[dependencies]
+# Rust-native heap profiler: the portable allocation bytes/counts signal that
+# backs continuous memory tracking (Spec 06 §5/§10, decision D1).
+dhat = "0.3"
+# Typed errors for baseline-file parsing (workspace convention: thiserror, no anyhow).
+thiserror = { workspace = true }
+
+[dev-dependencies]
+# Statistical timed-bench harness — variance-robust, suits the noisy local
+# environment (Spec 06 §10).
+criterion = "0.8"
+# The workloads the portable benches drive (Spec 06 §6). Dev-deps so they build
+# only for the bench targets, never for the harness library itself.
+loki-doc-model = { path = "../loki-doc-model" }
+loki-layout = { path = "../loki-layout" }
+loki-ooxml = { path = "../loki-ooxml" }
+loki-odf = { path = "../loki-odf" }
+
+[[bench]]
+name = "portable_smoke"
+harness = false
+
+[[bench]]
+name = "portable_alloc"
+harness = false
+
+[[bench]]
+name = "device_frame_time"
+harness = false
+
+[[bench]]
+name = "device_rss"
+harness = false
+
+[[bench]]
+name = "parity_status"
+harness = false
+
+[[bench]]
+name = "portable_style_resolution"
+harness = false
+
+[[bench]]
+name = "portable_layout"
+harness = false
+
+[[bench]]
+name = "portable_model"
+harness = false
+
+[[bench]]
+name = "portable_io"
+harness = false
+
+[[bench]]
+name = "portable_export"
+harness = false
+
+[[bench]]
+name = "arc_steady_state"
+harness = false
+
+[[bench]]
+name = "baseline"
+harness = false
+
+[[bench]]
+name = "leak_detection"
+harness = false
+
+[[bench]]
+name = "leak_loro_history"
+harness = false
+
+[package.metadata.docs.rs]
+all-features = true
diff --git a/loki-bench/README.md b/loki-bench/README.md
new file mode 100644
index 00000000..3c774a28
--- /dev/null
+++ b/loki-bench/README.md
@@ -0,0 +1,94 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+-->
+
+# loki-bench — benchmarking & continuous memory tracking (Spec 06)
+
+Shared harness at the monorepo root for Loki's performance and **continuous
+memory** benchmarks. Implements the [Spec 06](../docs/adr/spec-06-benchmarking-and-memory-tracking.md)
+**two-axis split**; see the [audit](../docs/adr/spec-06-benchmarking-audit.md) for
+ground truth.
+
+## The two axes (§5)
+
+| Axis | Metrics | Runs where |
+|------|---------|------------|
+| **Portable** | heap allocation bytes/counts (dhat), op counts, `vello_cpu` render cost | agent / CI / any dev machine — **headless, no GPU** |
+| **Device-bound** | GPU frame-time, wall-clock latency, real peak RSS | real hardware only |
+
+`Axis` / `Metric` (in `src/axis.rs`) encode this in code: `Metric::axis()` maps
+allocation bytes/counts to `Portable` (the continuously-tracked signal, decision
+D1) and RSS/frame-time to `DeviceBound`.
+
+## What M1 provides
+
+- The `Axis` / `Metric` model and its mapping (tested, headless).
+- `measure(|| workload) -> AllocStats` — portable allocation bytes/counts via dhat.
+- `dhat_global_allocator!()` — opt a bench binary into dhat recording.
+- Criterion wired via `benches/`.
+
+```bash
+cargo test  -p loki-bench                              # axis + measurement unit tests (headless)
+cargo bench -p loki-bench --bench portable_smoke       # Criterion runs headless
+cargo bench -p loki-bench --bench portable_alloc       # dhat captures allocation bytes/counts headless
+cargo bench -p loki-bench --bench device_frame_time    # hardware-only: prints a skip notice headless
+```
+
+## Continuous memory tracking (M3)
+
+`baselines/portable.txt` is the committed per-tier baseline (one line per key).
+Each run diffs against it and surfaces deltas for **review** — never a CI failure
+(§11). The Arc steady-state guard asserts sharing allocates nothing.
+
+```bash
+cargo bench -p loki-bench --bench baseline               # diff current run vs committed baseline
+cargo bench -p loki-bench --bench baseline -- --update   # rewrite the baseline (intentional)
+cargo bench -p loki-bench --bench arc_steady_state       # assert Arc::clone allocates 0
+```
+
+## Leak detection (M4)
+
+Residual live-heap measurement (`residual_after`) + a pure `classify_leak`
+verdict catch the §7 culprits: Arc cycles / retained documents, unbounded
+caches, and Loro history growth.
+
+```bash
+cargo bench -p loki-bench --bench leak_detection     # clean cycle Bounded; seeded leaks caught
+cargo bench -p loki-bench --bench leak_loro_history  # reports oplog growth over a long session
+```
+
+## Device benches + budgets (M5)
+
+Peak RSS is measurable now (Linux `/proc`; device-local numbers). Budgets are
+committed (`baselines/rss_budgets.txt`) and reviewed, not gated (§11). GPU
+frame-time is device-only (needs a GPU).
+
+```bash
+cargo bench -p loki-bench --bench device_rss               # peak RSS per tier + budget review
+cargo bench -p loki-bench --bench device_rss -- --update   # recalibrate budgets (1.5× measured peak)
+cargo bench -p loki-bench --bench device_frame_time --features device   # GPU frame-time (hardware only)
+```
+
+The committed budgets are **agent-provisional** — they under-count real devices
+(no GPU textures); see [`docs/adr/spec-06-calibration.md`](../docs/adr/spec-06-calibration.md)
+for the recalibration steps on Kevin's hardware (audit BM-14).
+
+## Discipline + parity cadence (M6)
+
+The tracked-not-gated discipline and the CPU/GPU parity cadence are written down
+in [`docs/adr/spec-06-discipline.md`](../docs/adr/spec-06-discipline.md). The "on
+every Vello bump" trigger is mechanical:
+
+```bash
+cargo bench -p loki-bench --bench parity_status              # DUE if pinned vello != last confirmed
+cargo bench -p loki-bench --bench parity_status -- --update  # record a confirmed run (after on-device pass)
+```
+
+The parity *check* it prompts needs a GPU + Spec 02's `vello_cpu` path (BM-3), so
+the marker is currently unconfirmed and the tool reports `[DUE]`.
+
+## Status
+
+Spec 06 M1–M6 are shipped for the agent-runnable scope. Device-/upstream-gated
+remainders: GPU frame-time execution, on-device RSS recalibration (BM-14), and the
+`vello_cpu` render proxy + parity-check execution (BM-3, gated on Spec 02).
diff --git a/loki-bench/baselines/parity_marker.txt b/loki-bench/baselines/parity_marker.txt
new file mode 100644
index 00000000..a27d744b
--- /dev/null
+++ b/loki-bench/baselines/parity_marker.txt
@@ -0,0 +1,16 @@
+# loki-bench CPU/GPU parity cadence marker (Spec 06 M6 / §12).
+#
+# Records the Vello version the CPU/GPU parity check was last CONFIRMED against on
+# GPU hardware. `parity_status` compares this to the pinned `vello` in Cargo.lock
+# and flags a version bump as DUE (the mechanical §12 trigger).
+#
+# NOT YET CONFIRMED. The parity CHECK needs a GPU and Spec 02's `vello_cpu` render
+# path (audit BM-3), so no on-device run exists yet. Until one does, the cadence
+# tool correctly reports DUE for the current pin (vello 0.6.0). After a passing
+# on-device parity run, record the confirmed version (and note date/device/
+# tolerance) with:
+#
+#   cargo bench -p loki-bench --bench parity_status -- --update
+#
+# There is deliberately no `vello_version` line below yet → status is
+# "never confirmed", which is the honest current state.
diff --git a/loki-bench/baselines/portable.txt b/loki-bench/baselines/portable.txt
new file mode 100644
index 00000000..e0080723
--- /dev/null
+++ b/loki-bench/baselines/portable.txt
@@ -0,0 +1,21 @@
+# loki-bench portable memory baseline (Spec 06 M3).
+# Update intentionally: cargo bench -p loki-bench --bench baseline -- --update
+# key  total_bytes  total_blocks  max_bytes  max_blocks
+arc/share_font_resources                            0          0            0          0
+export/large_odt                              2216661       5129       502238         33
+export/medium_odt                             1617711       1327       393271         33
+export/small_odt                              1449585        324       364408         33
+io/large_open                                 6419674      18080      3561347       6111
+io/large_save                                 2752812       6484       624867         83
+io/medium_open                                1921306       4774       900757       1551
+io/medium_save                                2299839       1922       431317         89
+io/small_open                                  749856       1268       206808        351
+io/small_save                                 2186362        720       381285         83
+layout/large                                 40450212      59870     14124464      12215
+layout/medium                                 9737350      14325      3404897       2933
+layout/small                                  3223680       2533      2135824        607
+model/large                                   2072947      15031       589840       2030
+model/medium                                   498380       3627       143044        510
+model/small                                     84899        621        25934        110
+style_resolution/depth16_chains100             165330       2100         1313         17
+style_resolution/depth64_chains1000           3407370      38000         2635         31
diff --git a/loki-bench/baselines/rss_budgets.txt b/loki-bench/baselines/rss_budgets.txt
new file mode 100644
index 00000000..3f541ceb
--- /dev/null
+++ b/loki-bench/baselines/rss_budgets.txt
@@ -0,0 +1,6 @@
+# loki-bench per-tier peak-RSS budgets (Spec 06 M5 / §9, bytes).
+# Review targets, not gates. Recalibrate on device: see spec-06-calibration.md
+# tier  budget_bytes
+large                          36089856
+medium                         19101696
+small                          14573568
diff --git a/loki-bench/benches/arc_steady_state.rs b/loki-bench/benches/arc_steady_state.rs
new file mode 100644
index 00000000..65ba8c58
--- /dev/null
+++ b/loki-bench/benches/arc_steady_state.rs
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Arc steady-state guard (Spec 06 M3 / §7 / audit §4).
+//!
+//! The tiered render-cache win holds resident memory down by sharing
+//! `vello::Renderer`, `PaginatedLayout`, and `FontResources` behind `Arc` — one
+//! careless value-clone reverts that toward per-instance duplication. `Arc::clone`
+//! only bumps a refcount, so sharing a resource allocates **nothing on the heap**;
+//! a deep clone would allocate the whole resource. This guard measures the share
+//! path on a real shared resource (`FontResources`, constructed headless) and
+//! asserts it stays at **zero allocations** — the deterministic tripwire for a
+//! share→clone regression.
+//!
+//! `vello::Renderer` needs a GPU, so its identical guard is device-bound (M5);
+//! the mechanism proven here is the same.
+//!
+//! Run: `cargo bench -p loki-bench --bench arc_steady_state`
+
+loki_bench::dhat_global_allocator!();
+
+use loki_bench::measure;
+use loki_layout::FontResources;
+use std::hint::black_box;
+use std::sync::Arc;
+
+fn main() {
+    // Build the shared resource once (its font scan is outside the measured region).
+    let shared: Arc<FontResources> = Arc::new(FontResources::new());
+
+    // Share it 10_000 times via Arc::clone — a refcount bump, never a heap alloc.
+    let stats = measure(|| {
+        for _ in 0..10_000 {
+            let handle = Arc::clone(&shared);
+            black_box(&handle);
+        }
+    });
+
+    eprintln!(
+        "arc_steady_state — sharing FontResources via Arc::clone (10_000×):\n  \
+         bytes={} allocs={}  (both must be 0 — shared steady state holds)",
+        stats.total_bytes, stats.total_blocks,
+    );
+
+    assert_eq!(
+        stats.total_blocks, 0,
+        "Arc::clone allocated — the shared steady state regressed toward \
+         per-instance duplication (audit §4)",
+    );
+    assert_eq!(
+        stats.total_bytes, 0,
+        "Arc::clone must not allocate heap bytes"
+    );
+}
diff --git a/loki-bench/benches/baseline.rs b/loki-bench/benches/baseline.rs
new file mode 100644
index 00000000..7143c962
--- /dev/null
+++ b/loki-bench/benches/baseline.rs
@@ -0,0 +1,148 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Continuous-memory-tracking tool (Spec 06 M3 / §7 / §11).
+//!
+//! Collects the curated portable allocation metrics (a representative key per §6
+//! target × tier, plus the Arc steady-state guard metric), then diffs them
+//! against the committed baseline (`baselines/portable.txt`) and prints deltas
+//! for **review** — never a CI failure. `--update` rewrites the baseline
+//! intentionally, so git history shows how memory moves over releases.
+//!
+//! Run:    `cargo bench -p loki-bench --bench baseline`
+//! Update: `cargo bench -p loki-bench --bench baseline -- --update`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{
+    AllocStats, Baseline, DeltaStatus, Tolerance, any_regressed, diff, measure, render_report,
+};
+use loki_doc_model::io::{DocumentExport, DocumentImport};
+use loki_doc_model::{document_to_loro, loro_to_document};
+use loki_layout::{FontResources, LayoutMode, LayoutOptions, layout_document};
+use loki_odf::OdtExport;
+use loki_ooxml::{DocxExport, DocxImport};
+use std::hint::black_box;
+use std::io::Cursor;
+use std::sync::Arc;
+
+const BASELINE_PATH: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/baselines/portable.txt");
+
+/// Runs the curated tracked workloads once each, returning `(key, stats)` sorted.
+fn collect_samples() -> Vec<(String, AllocStats)> {
+    let mut out: Vec<(String, AllocStats)> = Vec::new();
+
+    // Style resolution — a representative and a pathological point (§6).
+    for &(depth, chains) in &[(16usize, 100usize), (64usize, 1000usize)] {
+        let (catalog, leaves) = support::build_style_chains(depth, chains);
+        let stats = measure(|| {
+            for leaf in &leaves {
+                black_box(catalog.resolve_para_chain(leaf, |s| s.para_props.alignment));
+            }
+        });
+        out.push((
+            format!("style_resolution/depth{depth}_chains{chains}"),
+            stats,
+        ));
+    }
+
+    // Doc-tier targets: layout, model rebuild, DOCX save/open, ODT export.
+    let mut resources = FontResources::new();
+    let options = LayoutOptions {
+        preserve_for_editing: true,
+        spell: None,
+    };
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+
+        resources.clear_paragraph_cache();
+        let layout = measure(|| {
+            black_box(layout_document(
+                &mut resources,
+                &doc,
+                LayoutMode::Paginated,
+                1.0,
+                &options,
+            ));
+        });
+        out.push((format!("layout/{name}"), layout));
+
+        let loro = document_to_loro(&doc).expect("document_to_loro");
+        let model = measure(|| {
+            let rebuilt = loro_to_document(&loro).expect("loro_to_document");
+            black_box(&rebuilt);
+        });
+        out.push((format!("model/{name}"), model));
+
+        let mut bytes = Vec::new();
+        let save = measure(|| {
+            let mut buf = Cursor::new(Vec::new());
+            DocxExport::export(&doc, &mut buf, ()).expect("docx export");
+            bytes = buf.into_inner();
+        });
+        out.push((format!("io/{name}_save"), save));
+
+        let open = measure(|| {
+            black_box(
+                DocxImport::import(Cursor::new(bytes.as_slice()), Default::default())
+                    .expect("docx import"),
+            );
+        });
+        out.push((format!("io/{name}_open"), open));
+
+        let odt = measure(|| {
+            let mut buf = Cursor::new(Vec::new());
+            OdtExport::export(&doc, &mut buf, Default::default()).expect("odt export");
+            black_box(buf.into_inner().len());
+        });
+        out.push((format!("export/{name}_odt"), odt));
+    }
+
+    // Arc steady-state guard (audit §4): sharing must not allocate → baseline 0.
+    let shared = Arc::new(resources);
+    let arc = measure(|| {
+        for _ in 0..10_000 {
+            black_box(Arc::clone(&shared));
+        }
+    });
+    out.push(("arc/share_font_resources".to_string(), arc));
+
+    out.sort_by(|a, b| a.0.cmp(&b.0));
+    out
+}
+
+fn main() {
+    let samples = collect_samples();
+
+    if std::env::args().any(|a| a == "--update") {
+        let rendered = Baseline::from_samples(&samples).render();
+        if let Some(dir) = std::path::Path::new(BASELINE_PATH).parent() {
+            std::fs::create_dir_all(dir).expect("create baselines dir");
+        }
+        std::fs::write(BASELINE_PATH, &rendered).expect("write baseline");
+        eprintln!("baseline updated: {} keys → {BASELINE_PATH}", samples.len());
+        return;
+    }
+
+    let Ok(text) = std::fs::read_to_string(BASELINE_PATH) else {
+        eprintln!("no committed baseline at {BASELINE_PATH}; create it with `-- --update`.");
+        return;
+    };
+    let base = Baseline::parse(&text).expect("parse committed baseline");
+    let deltas = diff(&samples, &base, Tolerance::default());
+
+    eprintln!("\nportable memory baseline diff ({} keys):", deltas.len());
+    eprint!("{}", render_report(&deltas));
+    let regressed = deltas
+        .iter()
+        .filter(|d| d.status == DeltaStatus::Regressed)
+        .count();
+    if any_regressed(&deltas) {
+        eprintln!("\n{regressed} key(s) REGRESSED — review (not a CI failure; Spec 06 §11).");
+    } else {
+        eprintln!("\nno regressions past tolerance.");
+    }
+}
diff --git a/loki-bench/benches/device_frame_time.rs b/loki-bench/benches/device_frame_time.rs
new file mode 100644
index 00000000..7379dab4
--- /dev/null
+++ b/loki-bench/benches/device_frame_time.rs
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! GPU frame-time (Spec 06 §5 / M5): the production paint path's per-frame cost,
+//! measured via **wgpu timestamp queries** on real hardware (Kevin's Windows+RTX
+//! 3050 / MacBook A16). It is **not agent-runnable** — the agent has no GPU — and
+//! never gates CI.
+//!
+//! This is the one M5 metric that cannot be executed or verified headless (peak
+//! RSS *is* runnable — see the `device_rss` target). It stays gated behind the
+//! `device` feature so no GPU dependency enters the default headless build; the
+//! on-device implementation wires wgpu timestamp queries around the
+//! `loki-renderer` paint path and records per-frame GPU time alongside the
+//! `device_rss` peak-RSS pass. See `docs/adr/spec-06-calibration.md`.
+//!
+//! Run (on GPU hardware): `cargo bench -p loki-bench --bench device_frame_time --features device`
+
+fn main() {
+    #[cfg(not(feature = "device"))]
+    {
+        eprintln!(
+            "device_frame_time — hardware-only (Spec 06 §5 / M5). Skipped: the agent \
+             environment has no GPU. Re-run on real hardware with `--features device`. \
+             Peak RSS (the runnable M5 metric) is the `device_rss` target."
+        );
+    }
+
+    #[cfg(feature = "device")]
+    {
+        eprintln!(
+            "device_frame_time — device feature enabled. The wgpu timestamp-query \
+             frame-time pass is wired around the loki-renderer paint path on-device \
+             (Spec 06 M5); see docs/adr/spec-06-calibration.md."
+        );
+    }
+}
diff --git a/loki-bench/benches/device_rss.rs b/loki-bench/benches/device_rss.rs
new file mode 100644
index 00000000..683d29eb
--- /dev/null
+++ b/loki-bench/benches/device_rss.rs
@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Peak-RSS measurement + per-tier budget review (Spec 06 M5 / §9 / §10).
+//!
+//! Builds and lays out each corpus tier (holding it live) and reads the OS peak
+//! RSS (`VmHWM`) — the device-bound memory reality check. It then compares each
+//! tier's peak against the committed budgets (`baselines/rss_budgets.txt`) and
+//! prints a **review** report — never a CI failure (§11).
+//!
+//! The mechanism runs headless on Linux (verifiable in the agent), but the
+//! *numbers are device-local* and, in the agent, **under-count real devices**
+//! (no GPU page textures, different allocator). Kevin must re-run this on the
+//! Windows+RTX 3050 / MacBook A16 and `-- --update` the budgets before they are
+//! authoritative (audit BM-14). GPU frame-time is the separate `device_frame_time`
+//! target (needs a GPU).
+//!
+//! Run:    `cargo bench -p loki-bench --bench device_rss`
+//! Update: `cargo bench -p loki-bench --bench device_rss -- --update`
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{BudgetStatus, Budgets, check, current_rss_bytes, headroom_frac, peak_rss_bytes};
+use loki_layout::{FontResources, LayoutMode, LayoutOptions, layout_document};
+use std::hint::black_box;
+
+const BUDGETS_PATH: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/baselines/rss_budgets.txt");
+/// Headroom multiplier over measured peak when calibrating a budget (§9): 50%.
+const HEADROOM: f64 = 1.5;
+
+fn mib(bytes: u64) -> f64 {
+    bytes as f64 / (1024.0 * 1024.0)
+}
+
+/// Builds + lays out each tier (held live) and returns `(tier, peak_rss_bytes)`.
+fn measure_tiers() -> Vec<(String, u64)> {
+    let Some(base) = peak_rss_bytes() else {
+        eprintln!("peak RSS unavailable on this platform (Spec 06 M5 §10: Linux only for now).");
+        return Vec::new();
+    };
+    eprintln!("  process baseline peak RSS: {:.1} MiB", mib(base));
+
+    let mut resources = FontResources::new();
+    let options = LayoutOptions {
+        preserve_for_editing: true,
+        spell: None,
+    };
+    let mut out = Vec::new();
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+        resources.clear_paragraph_cache();
+        let layout = layout_document(&mut resources, &doc, LayoutMode::Paginated, 1.0, &options);
+        black_box(&layout);
+        let peak = peak_rss_bytes().unwrap_or(base);
+        let cur = current_rss_bytes().unwrap_or(0);
+        eprintln!(
+            "  {name:<8} ({paras} paras): peak {:.1} MiB, current {:.1} MiB",
+            mib(peak),
+            mib(cur),
+        );
+        out.push((name.to_string(), peak));
+    }
+    out
+}
+
+fn main() {
+    eprintln!("\ndevice_rss — peak RSS per corpus tier (device-local; agent under-counts, BM-14):");
+    let tiers = measure_tiers();
+    if tiers.is_empty() {
+        return;
+    }
+
+    if std::env::args().any(|a| a == "--update") {
+        let pairs: Vec<(String, u64)> = tiers
+            .iter()
+            .map(|(t, peak)| (t.clone(), (*peak as f64 * HEADROOM) as u64))
+            .collect();
+        let rendered = Budgets::from_pairs(&pairs).render();
+        if let Some(dir) = std::path::Path::new(BUDGETS_PATH).parent() {
+            std::fs::create_dir_all(dir).expect("create baselines dir");
+        }
+        std::fs::write(BUDGETS_PATH, &rendered).expect("write budgets");
+        eprintln!("\nbudgets updated ({HEADROOM}× measured peak) → {BUDGETS_PATH}");
+        return;
+    }
+
+    let Ok(text) = std::fs::read_to_string(BUDGETS_PATH) else {
+        eprintln!("\nno committed budgets at {BUDGETS_PATH}; create with `-- --update`.");
+        return;
+    };
+    let budgets = Budgets::parse(&text).expect("parse budgets");
+    eprintln!("\nbudget review (target, not gate; §11):");
+    for (tier, peak) in &tiers {
+        match budgets.get(tier) {
+            Some(budget) => {
+                let tag = match check(*peak, budget) {
+                    BudgetStatus::WithinBudget => "ok",
+                    BudgetStatus::OverBudget => "OVER",
+                };
+                eprintln!(
+                    "  [{tag:<4}] {tier:<8} peak {:.1} MiB / budget {:.1} MiB ({:+.0}% headroom)",
+                    mib(*peak),
+                    mib(budget),
+                    headroom_frac(*peak, budget) * 100.0,
+                );
+            }
+            None => eprintln!("  [ ?  ] {tier:<8} no budget set"),
+        }
+    }
+}
diff --git a/loki-bench/benches/leak_detection.rs b/loki-bench/benches/leak_detection.rs
new file mode 100644
index 00000000..b8d2efea
--- /dev/null
+++ b/loki-bench/benches/leak_detection.rs
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Leak detection (Spec 06 M4 / §7): the Arc-cycle / retained-document and
+//! unbounded-cache culprits.
+//!
+//! Measures the live heap still held after a document open→edit→close cycle,
+//! once and after many cycles. A clean cycle leaves a flat residual (everything
+//! frees); a **seeded** leak — retaining each opened document, or a cache that
+//! never evicts — makes the residual scale with the cycle count, which
+//! [`classify_leak`] flags. Asserting the seeded leaks are caught while the clean
+//! cycle is not is the M4 acceptance.
+//!
+//! Run: `cargo bench -p loki-bench --bench leak_detection`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{LeakVerdict, ResidualStats, classify_leak, residual_after};
+use loki_doc_model::{delete_text, document_to_loro, insert_text};
+use std::hint::black_box;
+
+/// Cycles measured at the "many" repetition count.
+const N: usize = 64;
+/// Paragraphs per opened document (a chunky working document).
+const CYCLE_PARAS: usize = 200;
+/// One-time/noise envelope: growth below this is not a per-cycle leak.
+const SLACK: u64 = 2 * 1024 * 1024;
+
+/// A full document lifecycle: open (build + reconstruct via CRDT), edit (one
+/// keystroke in and out), close (everything dropped at scope end).
+fn open_edit_close() {
+    let doc = support::build_doc(CYCLE_PARAS, support::WORDS_PER_PARA);
+    let loro = document_to_loro(&doc).expect("document_to_loro");
+    let _ = insert_text(&loro, 0, 0, "x");
+    let _ = delete_text(&loro, 0, 0, 1);
+}
+
+fn report(label: &str, one: ResidualStats, many: ResidualStats, verdict: LeakVerdict) {
+    eprintln!(
+        "  {label}:\n    after 1: {} B / {} allocs   after {N}: {} B / {} allocs  → {verdict:?}",
+        one.curr_bytes, one.curr_blocks, many.curr_bytes, many.curr_blocks,
+    );
+}
+
+fn main() {
+    eprintln!("\nleak detection — residual live heap after open/edit/close cycles:");
+
+    // Warm any one-time globals so both measurements start from the same state.
+    open_edit_close();
+
+    // (a) Clean cycle — residual must stay flat as cycles grow.
+    let clean_1 = residual_after(1, open_edit_close);
+    let clean_n = residual_after(N, open_edit_close);
+    let clean = classify_leak(clean_1.curr_bytes, clean_n.curr_bytes, SLACK);
+    report("clean open/edit/close", clean_1, clean_n, clean);
+
+    // (b) Seeded leak: retain every opened document (an Arc cycle never frees it).
+    let mut retained: Vec<_> = Vec::new();
+    let open_retain = |sink: &mut Vec<_>| {
+        let doc = support::build_doc(CYCLE_PARAS, support::WORDS_PER_PARA);
+        sink.push(document_to_loro(&doc).expect("document_to_loro"));
+    };
+    let leak_1 = residual_after(1, || open_retain(&mut retained));
+    let leak_n = residual_after(N, || open_retain(&mut retained));
+    let leak = classify_leak(leak_1.curr_bytes, leak_n.curr_bytes, SLACK);
+    report("seeded retained-document leak", leak_1, leak_n, leak);
+    black_box(&retained);
+
+    // (c) Seeded unbounded cache: a cache that never evicts (64 KiB per entry).
+    let mut cache: Vec<Vec<u8>> = Vec::new();
+    let cache_1 = residual_after(1, || cache.push(vec![0u8; 64 * 1024]));
+    let cache_n = residual_after(N, || cache.push(vec![0u8; 64 * 1024]));
+    let cache_v = classify_leak(cache_1.curr_bytes, cache_n.curr_bytes, SLACK);
+    report("seeded unbounded cache", cache_1, cache_n, cache_v);
+    black_box(&cache);
+
+    // Acceptance: both seeded leaks caught; the clean cycle returns to baseline.
+    assert!(leak.leaks(), "seeded retained-document leak was not caught");
+    assert!(cache_v.leaks(), "seeded unbounded cache was not caught");
+    assert!(
+        !clean.leaks(),
+        "clean open/edit/close was flagged as leaking — real retention on the \
+         open/edit/close path (investigate before trusting the detector)",
+    );
+    eprintln!("\nboth seeded leaks caught; clean cycle returned to baseline.");
+}
diff --git a/loki-bench/benches/leak_loro_history.rs b/loki-bench/benches/leak_loro_history.rs
new file mode 100644
index 00000000..7e5b246e
--- /dev/null
+++ b/loki-bench/benches/leak_loro_history.rs
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Loro history growth (Spec 06 M4 / §7): the sneakiest culprit — it grows with
+//! session *time*, not document size.
+//!
+//! Simulates a long editing session (insert then delete a character, so the
+//! document length is stable) and **measures and reports** how the CRDT oplog and
+//! tombstones grow: the op/change counters (`len_ops` / `len_changes`, the same
+//! signals `loki_text::mem` logs) and the live heap the session retains. This
+//! confirms and quantifies the known unbounded growth (memory-audit Finding 6 /
+//! `TODO(loro-compaction)`); it is the yardstick a future compaction fix is
+//! validated against — a fix should flatten this curve.
+//!
+//! Run: `cargo bench -p loki-bench --bench leak_loro_history`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::residual_after;
+use loki_doc_model::{delete_text, document_to_loro, insert_text};
+use std::hint::black_box;
+
+const KEYSTROKES: usize = 5_000;
+
+fn main() {
+    let doc = support::build_doc(20, support::WORDS_PER_PARA);
+    let loro = document_to_loro(&doc).expect("document_to_loro");
+    let ops0 = loro.len_ops();
+    let changes0 = loro.len_changes();
+
+    let residual = residual_after(1, || {
+        for _ in 0..KEYSTROKES {
+            let _ = insert_text(&loro, 0, 0, "x");
+            let _ = delete_text(&loro, 0, 0, 1);
+        }
+    });
+
+    let ops1 = loro.len_ops();
+    let changes1 = loro.len_changes();
+    let d_ops = ops1 - ops0;
+    let d_changes = changes1 - changes0;
+
+    eprintln!(
+        "\nloro history over {KEYSTROKES} keystrokes (insert+delete; length stable):\n  \
+         ops:     {ops0} → {ops1}  (+{d_ops})\n  \
+         changes: {changes0} → {changes1}  (+{d_changes})\n  \
+         live heap retained by the session: {} B / {} allocs\n  \
+         per-keystroke: {:.2} ops, {} B",
+        residual.curr_bytes,
+        residual.curr_blocks,
+        d_ops as f64 / KEYSTROKES as f64,
+        residual.curr_bytes / KEYSTROKES as u64,
+    );
+    eprintln!(
+        "  → history grows with edit count (Finding 6 / TODO(loro-compaction)); \
+         a compaction fix should flatten this."
+    );
+
+    // Measured & reported (not a pass/fail): editing must move the oplog.
+    assert!(ops1 > ops0, "oplog did not grow — did the edits apply?");
+    black_box(&loro);
+}
diff --git a/loki-bench/benches/parity_status.rs b/loki-bench/benches/parity_status.rs
new file mode 100644
index 00000000..ad405a0c
--- /dev/null
+++ b/loki-bench/benches/parity_status.rs
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! CPU/GPU parity cadence — version-bump trigger (Spec 06 M6 / §12).
+//!
+//! Reads the currently pinned Vello version from `Cargo.lock` and compares it to
+//! the version the parity check was last **confirmed** against on GPU hardware
+//! (`baselines/parity_marker.txt`). Prints whether a parity check is **due** — the
+//! mechanical trigger for §12's "on every Vello version bump."
+//!
+//! This runs headless (it only reads versions), so the *trigger* is verifiable in
+//! the agent; the parity *check* it prompts needs a GPU and Spec 02's `vello_cpu`
+//! render path (audit BM-3) and runs on-device. After a successful on-device run,
+//! `-- --update` records the confirmed version. See docs/adr/spec-06-discipline.md.
+//!
+//! Run:    `cargo bench -p loki-bench --bench parity_status`
+//! Update: `cargo bench -p loki-bench --bench parity_status -- --update` (after an on-device pass)
+
+use loki_bench::{
+    ParityStatus, confirmed_version_from_marker, parity_status, render_marker,
+    vello_version_from_lock,
+};
+
+const LOCK_PATH: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/../Cargo.lock");
+const MARKER_PATH: &str = concat!(env!("CARGO_MANIFEST_DIR"), "/baselines/parity_marker.txt");
+
+fn main() {
+    let lock = std::fs::read_to_string(LOCK_PATH).expect("read Cargo.lock");
+    let Some(current) = vello_version_from_lock(&lock) else {
+        eprintln!("no `vello` package in Cargo.lock — nothing to track.");
+        return;
+    };
+
+    if std::env::args().any(|a| a == "--update") {
+        if let Some(dir) = std::path::Path::new(MARKER_PATH).parent() {
+            std::fs::create_dir_all(dir).expect("create baselines dir");
+        }
+        std::fs::write(MARKER_PATH, render_marker(&current)).expect("write marker");
+        eprintln!(
+            "parity marker updated: confirmed vello {current} → {MARKER_PATH}\n  \
+             (only do this AFTER a passing on-device parity run — §12)"
+        );
+        return;
+    }
+
+    let confirmed = std::fs::read_to_string(MARKER_PATH)
+        .ok()
+        .and_then(|m| confirmed_version_from_marker(&m));
+
+    eprintln!("\nCPU/GPU parity cadence (Spec 06 §12):");
+    match parity_status(&current, confirmed.as_deref()) {
+        ParityStatus::UpToDate => {
+            eprintln!("  [ok]  parity confirmed against pinned vello {current}.");
+        }
+        ParityStatus::Due { last, current } => {
+            eprintln!(
+                "  [DUE] vello bumped {last} → {current}. Re-run the CPU/GPU parity\n        \
+                 check on GPU hardware; investigate any divergence before trusting the\n        \
+                 Spec 02 goldens, then `-- --update`."
+            );
+        }
+        ParityStatus::NeverRun { current } => {
+            eprintln!(
+                "  [DUE] no confirmed parity run on record for vello {current}. Run the\n        \
+                 CPU/GPU parity check on GPU hardware, then `-- --update`."
+            );
+        }
+    }
+    eprintln!(
+        "  Note: the parity check itself needs a GPU + Spec 02's vello_cpu path (BM-3);\n  \
+         this target only detects the version-bump trigger."
+    );
+}
diff --git a/loki-bench/benches/portable_alloc.rs b/loki-bench/benches/portable_alloc.rs
new file mode 100644
index 00000000..585487e3
--- /dev/null
+++ b/loki-bench/benches/portable_alloc.rs
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable allocation-metric proof (Spec 06 M1): installs dhat's global
+//! allocator and shows `loki_bench::measure` captures real, hardware-independent
+//! allocation bytes/counts headless — the signal that backs continuous memory
+//! tracking (decision D1). The per-tier baselines that diff these numbers land
+//! in M3.
+//!
+//! `harness = false`: this is a plain binary, not a Criterion timed bench, so it
+//! reports the portable memory signal rather than a distribution.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_alloc`
+
+loki_bench::dhat_global_allocator!();
+
+fn main() {
+    // A trivial, deterministic portable workload: allocate a known collection.
+    let stats = loki_bench::measure(|| {
+        let v: Vec<u64> = (0..10_000).collect();
+        std::hint::black_box(&v);
+    });
+
+    eprintln!(
+        "portable_alloc — dhat allocation signal (headless, no GPU):\n  \
+         total_bytes={} total_blocks={} max_bytes={} max_blocks={}",
+        stats.total_bytes, stats.total_blocks, stats.max_bytes, stats.max_blocks,
+    );
+
+    // With the global allocator installed the workload must register a signal;
+    // this is the M1 acceptance that the portable memory path works headless.
+    assert!(
+        stats.total_bytes > 0 && stats.total_blocks > 0,
+        "dhat recorded no allocations — is the global allocator installed?",
+    );
+}
diff --git a/loki-bench/benches/portable_export.rs b/loki-bench/benches/portable_export.rs
new file mode 100644
index 00000000..a73c280e
--- /dev/null
+++ b/loki-bench/benches/portable_export.rs
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable export bench (Spec 06 M2 / §6): document-emission allocations across
+//! formats, DOCX vs ODT, over the scale tiers — so format-emission cost is
+//! comparable and a regression in either is visible.
+//!
+//! PDF/EPUB emission additionally drives the layout pipeline (`loki-layout`);
+//! those are portable too and land as a follow-up within the export target so
+//! this bench stays a focused format-comparison of the two office writers.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_export`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{AllocStats, measure};
+use loki_doc_model::io::DocumentExport;
+use loki_odf::OdtExport;
+use loki_ooxml::DocxExport;
+use std::hint::black_box;
+use std::io::Cursor;
+
+fn main() {
+    support::header("export — DOCX vs ODT emission allocations");
+
+    let mut worst = AllocStats::default();
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+
+        let docx = measure(|| {
+            let mut buf = Cursor::new(Vec::new());
+            // DocxExport's Options is the unit type; `()` avoids clippy::unit_arg.
+            DocxExport::export(&doc, &mut buf, ()).expect("docx export");
+            black_box(buf.into_inner().len());
+        });
+        support::report_row(&format!("{name} docx"), docx);
+
+        let odt = measure(|| {
+            let mut buf = Cursor::new(Vec::new());
+            OdtExport::export(&doc, &mut buf, Default::default()).expect("odt export");
+            black_box(buf.into_inner().len());
+        });
+        support::report_row(&format!("{name} odt"), odt);
+        worst = odt;
+    }
+
+    assert!(worst.total_bytes > 0, "export recorded no allocations");
+}
diff --git a/loki-bench/benches/portable_io.rs b/loki-bench/benches/portable_io.rs
new file mode 100644
index 00000000..40982123
--- /dev/null
+++ b/loki-bench/benches/portable_io.rs
@@ -0,0 +1,54 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable open/save bench (Spec 06 M2 / §6): DOCX import (open) and export
+//! (save) allocations, across the scale tiers.
+//!
+//! Measures the parse/serialize halves of open and save (the IO wall-clock tail
+//! is device-bound and lives on the device axis). Save is measured first to
+//! produce the bytes the open measurement reads; the input slice is borrowed
+//! (not cloned) inside the open region so only the import allocates.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_io`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{AllocStats, measure};
+use loki_doc_model::io::{DocumentExport, DocumentImport};
+use loki_ooxml::{DocxExport, DocxImport};
+use std::hint::black_box;
+use std::io::Cursor;
+
+fn main() {
+    support::header("open/save — DOCX export (save) + import (open) allocations");
+
+    let mut worst = AllocStats::default();
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+
+        // Save: serialize the document to DOCX bytes.
+        let mut bytes = Vec::new();
+        let save = measure(|| {
+            let mut buf = Cursor::new(Vec::new());
+            // DocxExport's Options is the unit type; pass `()` (not
+            // `Default::default()`, which trips clippy::unit_arg).
+            DocxExport::export(&doc, &mut buf, ()).expect("docx export");
+            bytes = buf.into_inner();
+        });
+        support::report_row(&format!("{name} save (docx)"), save);
+
+        // Open: parse those bytes back (borrow the slice, so the clone isn't charged).
+        let open = measure(|| {
+            let imported = DocxImport::import(Cursor::new(bytes.as_slice()), Default::default())
+                .expect("docx import");
+            black_box(&imported);
+        });
+        support::report_row(&format!("{name} open (docx)"), open);
+        worst = open;
+    }
+
+    assert!(worst.total_bytes > 0, "open/save recorded no allocations");
+}
diff --git a/loki-bench/benches/portable_layout.rs b/loki-bench/benches/portable_layout.rs
new file mode 100644
index 00000000..59361a16
--- /dev/null
+++ b/loki-bench/benches/portable_layout.rs
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable layout bench (Spec 06 M2 / §6): allocations to lay out a document
+//! (Parley text layout + pagination), across the scale tiers.
+//!
+//! `FontResources` is built once (the ~20 MB font scan is the editor's shared,
+//! amortised cost — not charged per layout), and the paragraph cache is cleared
+//! before each tier so the number is the **cold-layout** allocation cost, the
+//! signal for "did layout get heavier."
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_layout`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{AllocStats, measure};
+use loki_layout::{FontResources, LayoutMode, LayoutOptions, layout_document};
+use std::hint::black_box;
+
+fn main() {
+    support::header("layout — allocations to lay out a document (Paginated, cold paragraph cache)");
+
+    let mut resources = FontResources::new();
+    let options = LayoutOptions {
+        preserve_for_editing: true,
+        spell: None,
+    };
+
+    let mut worst = AllocStats::default();
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+        resources.clear_paragraph_cache();
+        let stats = measure(|| {
+            let layout =
+                layout_document(&mut resources, &doc, LayoutMode::Paginated, 1.0, &options);
+            black_box(&layout);
+        });
+        support::report_row(&format!("{name} ({paras} paras)"), stats);
+        worst = stats;
+    }
+
+    assert!(worst.total_bytes > 0, "layout recorded no allocations");
+}
diff --git a/loki-bench/benches/portable_model.rs b/loki-bench/benches/portable_model.rs
new file mode 100644
index 00000000..95695fbf
--- /dev/null
+++ b/loki-bench/benches/portable_model.rs
@@ -0,0 +1,43 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable model bench (Spec 06 M2 / §6): allocations to reconstruct the whole
+//! `Document` from the Loro CRDT — the model half of typing latency.
+//!
+//! The editor rebuilds the document from the CRDT on the edit path
+//! (`apply_mutation_and_relayout` → `loro_to_document`), so this is the
+//! per-keystroke model-rebuild allocation cost, swept across the scale tiers.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_model`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{AllocStats, measure};
+use loki_doc_model::{document_to_loro, loro_to_document};
+use std::hint::black_box;
+
+fn main() {
+    support::header(
+        "model — allocations to reconstruct the Document from the CRDT (per-keystroke rebuild)",
+    );
+
+    let mut worst = AllocStats::default();
+    for &(name, paras) in support::DOC_TIERS {
+        let doc = support::build_doc(paras, support::WORDS_PER_PARA);
+        let loro = document_to_loro(&doc).expect("document_to_loro");
+        let stats = measure(|| {
+            let rebuilt = loro_to_document(&loro).expect("loro_to_document");
+            black_box(&rebuilt);
+        });
+        support::report_row(&format!("{name} ({paras} paras)"), stats);
+        worst = stats;
+    }
+
+    assert!(
+        worst.total_bytes > 0,
+        "model rebuild recorded no allocations"
+    );
+}
diff --git a/loki-bench/benches/portable_smoke.rs b/loki-bench/benches/portable_smoke.rs
new file mode 100644
index 00000000..a44e9746
--- /dev/null
+++ b/loki-bench/benches/portable_smoke.rs
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable-axis smoke bench (Spec 06 M1): proves the Criterion harness runs
+//! headless in the agent environment with no GPU. This is a placeholder target
+//! — the per-operation portable benches (typing/layout/IO/export/style) land in
+//! M2 and replace it.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_smoke`
+
+use criterion::{Criterion, criterion_group, criterion_main};
+use loki_bench::{Axis, Metric};
+use std::hint::black_box;
+
+fn portable_smoke(c: &mut Criterion) {
+    // The portable axis is, by construction, agent-runnable — assert it so this
+    // target documents the axis it belongs to.
+    assert!(Metric::WallTime.axis() == Axis::DeviceBound);
+    assert!(Axis::Portable.is_agent_runnable());
+
+    c.bench_function("portable/smoke_sum", |b| {
+        b.iter(|| {
+            let sum: u64 = (0..black_box(1_000u64)).sum();
+            black_box(sum)
+        });
+    });
+}
+
+criterion_group!(benches, portable_smoke);
+criterion_main!(benches);
diff --git a/loki-bench/benches/portable_style_resolution.rs b/loki-bench/benches/portable_style_resolution.rs
new file mode 100644
index 00000000..43738599
--- /dev/null
+++ b/loki-bench/benches/portable_style_resolution.rs
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable style-resolution bench (Spec 06 M2 / §6, the headline target).
+//!
+//! Provenance-aware resolution runs on every inspector open and every dependent
+//! recompute (Spec 05). This measures the **allocations** to resolve a leaf
+//! style's property when the value lives at the chain root, so each resolve walks
+//! the full inheritance chain (worst-case `Inherited`). The sweep is deep chains
+//! × many styles, so the depth × count scaling — the §6 super-linear watch — is
+//! visible in one table.
+//!
+//! Run: `cargo bench -p loki-bench --bench portable_style_resolution`
+
+loki_bench::dhat_global_allocator!();
+
+#[path = "support/mod.rs"]
+mod support;
+
+use loki_bench::{AllocStats, measure};
+use std::hint::black_box;
+
+fn main() {
+    support::header(
+        "style resolution — allocations to resolve a leaf's alignment (walks the full chain)",
+    );
+    eprintln!("  each row resolves `chains` leaves, each walking a `depth`-deep chain:");
+
+    let mut worst = AllocStats::default();
+    for &depth in support::STYLE_DEPTHS {
+        for &chains in support::STYLE_CHAINS {
+            let (catalog, leaves) = support::build_style_chains(depth, chains);
+            let stats = measure(|| {
+                for leaf in &leaves {
+                    let resolved = catalog.resolve_para_chain(leaf, |s| s.para_props.alignment);
+                    black_box(&resolved);
+                }
+            });
+            support::report_row(&format!("depth={depth:<3} chains={chains:<5}"), stats);
+            worst = stats;
+        }
+    }
+
+    assert!(
+        worst.total_bytes > 0,
+        "resolution recorded no allocations — is the dhat allocator installed?",
+    );
+}
diff --git a/loki-bench/benches/support/mod.rs b/loki-bench/benches/support/mod.rs
new file mode 100644
index 00000000..98c5fea5
--- /dev/null
+++ b/loki-bench/benches/support/mod.rs
@@ -0,0 +1,146 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Shared scale-corpus builders + report formatting for the portable benches
+//! (Spec 06 M2 / §8).
+//!
+//! Lives in `benches/support/` (a subdirectory) so Cargo does *not* auto-detect
+//! it as a bench target; each bench `#[path]`-includes it. The generators are
+//! deterministic (no RNG) so successive runs are comparable, and the tier presets
+//! are the *scale* corpus (size), distinct from Spec 02's feature fixtures.
+
+#![allow(dead_code)] // Each bench uses a different subset of these helpers.
+
+use loki_bench::AllocStats;
+use loki_doc_model::content::attr::ExtensionBag;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::Inline;
+use loki_doc_model::document::Document;
+use loki_doc_model::layout::page::PageLayout;
+use loki_doc_model::layout::section::Section;
+use loki_doc_model::style::props::char_props::CharProps;
+use loki_doc_model::style::props::para_props::{ParaProps, ParagraphAlignment};
+use loki_doc_model::style::{ParagraphStyle, StyleCatalog, StyleId};
+
+/// A small fixed word pool — cycling it gives varied line breaks without a
+/// Lorem-ipsum dependency.
+const WORDS: &[&str] = &[
+    "loki",
+    "document",
+    "layout",
+    "reflow",
+    "paragraph",
+    "cursor",
+    "glyph",
+    "render",
+    "office",
+    "fidelity",
+    "shaping",
+    "parley",
+    "baseline",
+    "indent",
+];
+
+fn words(start: usize, count: usize) -> String {
+    let mut s = String::new();
+    for i in 0..count {
+        if i > 0 {
+            s.push(' ');
+        }
+        s.push_str(WORDS[(start + i) % WORDS.len()]);
+    }
+    s
+}
+
+/// One paragraph split into plain / bold / italic runs so each carries multiple
+/// style spans (exercising the per-run path, not one homogeneous run).
+fn paragraph(seed: usize, n: usize) -> Block {
+    let bold = (n / 4).max(1);
+    let italic = (n / 4).max(1);
+    let plain = n.saturating_sub(bold + italic).max(1);
+    Block::Para(vec![
+        Inline::Str(format!("{}. ", seed + 1)),
+        Inline::Str(words(seed, plain)),
+        Inline::Str(" ".into()),
+        Inline::Strong(vec![Inline::Str(words(seed + plain, bold))]),
+        Inline::Str(" ".into()),
+        Inline::Emph(vec![Inline::Str(words(seed + plain + bold, italic))]),
+    ])
+}
+
+/// Builds a [`Document`] of `paras` paragraphs (`words_per_para` words each) in a
+/// single default-page section — the scale workload the doc benches sweep over.
+pub fn build_doc(paras: usize, words_per_para: usize) -> Document {
+    let blocks: Vec<Block> = (0..paras).map(|i| paragraph(i, words_per_para)).collect();
+    let section = Section::with_layout_and_blocks(PageLayout::default(), blocks);
+    let mut doc = Document::new();
+    doc.sections = vec![section];
+    doc
+}
+
+/// Builds `chains` independent inheritance chains, each `depth` styles deep.
+///
+/// Only each chain's **root** sets `alignment`, so resolving a leaf walks the
+/// full `depth` before finding the value (worst-case Inherited) — the §6 stressor
+/// for "deep chains × many styles." Returns the catalog and the leaf ids to
+/// resolve (one per chain). Total styles = `depth × chains`.
+pub fn build_style_chains(depth: usize, chains: usize) -> (StyleCatalog, Vec<StyleId>) {
+    let mut cat = StyleCatalog::new();
+    let mut leaves = Vec::with_capacity(chains);
+    for c in 0..chains {
+        let mut parent: Option<StyleId> = None;
+        for d in 0..depth {
+            let id = StyleId::new(format!("c{c}s{d}"));
+            let mut props = ParaProps::default();
+            if d == 0 {
+                props.alignment = Some(ParagraphAlignment::Center);
+            }
+            cat.paragraph_styles.insert(
+                id.clone(),
+                ParagraphStyle {
+                    id: id.clone(),
+                    display_name: None,
+                    parent: parent.clone(),
+                    linked_char_style: None,
+                    para_props: props,
+                    char_props: CharProps::default(),
+                    next_style_id: None,
+                    is_default: false,
+                    is_custom: true,
+                    extensions: ExtensionBag::default(),
+                },
+            );
+            if d == depth - 1 {
+                leaves.push(id.clone());
+            }
+            parent = Some(id);
+        }
+    }
+    (cat, leaves)
+}
+
+/// Scale-corpus tiers for the document benches: `(label, paragraphs)`. Small ≈ a
+/// page or two, Medium ≈ tens of pages, Large ≈ hundreds (Spec 06 §8).
+pub const DOC_TIERS: &[(&str, usize)] = &[("small", 10), ("medium", 60), ("large", 250)];
+
+/// Words per paragraph across the harness (a typical body paragraph).
+pub const WORDS_PER_PARA: usize = 60;
+
+/// Chain depths swept by the style-resolution bench (1 → deep).
+pub const STYLE_DEPTHS: &[usize] = &[1, 4, 16, 64];
+
+/// Chain counts swept by the style-resolution bench (few → pathological).
+pub const STYLE_CHAINS: &[usize] = &[1, 100, 1000];
+
+/// Prints a bench section header to stderr.
+pub fn header(title: &str) {
+    eprintln!("\n{title}\n  (portable allocation metrics — hardware-independent, Spec 06 D1)");
+}
+
+/// Prints one aligned metric row: label + cumulative bytes/allocs + live peak.
+pub fn report_row(label: &str, s: AllocStats) {
+    eprintln!(
+        "  {label:<26} bytes={:>12} allocs={:>9} peak_bytes={:>12}",
+        s.total_bytes, s.total_blocks, s.max_bytes,
+    );
+}
diff --git a/loki-bench/src/axis.rs b/loki-bench/src/axis.rs
new file mode 100644
index 00000000..bdf418b8
--- /dev/null
+++ b/loki-bench/src/axis.rs
@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! The two-axis split (Spec 06 §5) and the per-metric axis mapping (decision D1).
+
+/// Which axis a benchmark belongs to — the single fact that decides *where it
+/// runs* and *whether its number is tracked across machines*.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Axis {
+    /// Hardware-independent: allocation bytes/counts, op counts, `vello_cpu`
+    /// render cost. Runs headless in the agent environment with no GPU; its
+    /// numbers are diffable across machines and over time.
+    Portable,
+    /// Hardware-dependent: GPU frame-time, wall-clock latency, real peak RSS.
+    /// Runs only on real hardware; a local reference point, not a tracked signal.
+    DeviceBound,
+}
+
+impl Axis {
+    /// `true` when this axis runs headless in the agent environment (no GPU).
+    #[must_use]
+    pub fn is_agent_runnable(self) -> bool {
+        matches!(self, Axis::Portable)
+    }
+
+    /// `true` when this axis needs real hardware and must not run in CI/agent.
+    #[must_use]
+    pub fn is_hardware_only(self) -> bool {
+        matches!(self, Axis::DeviceBound)
+    }
+
+    /// A stable slug for baseline files and report grouping.
+    #[must_use]
+    pub fn slug(self) -> &'static str {
+        match self {
+            Axis::Portable => "portable",
+            Axis::DeviceBound => "device",
+        }
+    }
+}
+
+/// A concrete quantity a benchmark measures. Each maps to exactly one [`Axis`],
+/// which is where the §5 table becomes code: allocation bytes/counts are the
+/// portable, continuously-tracked memory signal (D1); RSS and frame-time are
+/// device-local reality checks.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
+pub enum Metric {
+    /// Total heap bytes allocated over a region (dhat). Portable.
+    AllocBytes,
+    /// Total heap allocations over a region (dhat). Portable.
+    AllocBlocks,
+    /// A domain op count (model/layout/IO/style operations). Portable.
+    OpCount,
+    /// `vello_cpu` render cost — the hardware-independent render proxy. Portable.
+    RenderCost,
+    /// Wall-clock latency of an operation. Device-bound (CPU/scheduler variance).
+    WallTime,
+    /// Real resident-set-size peak. Device-bound (allocator/OS overhead).
+    PeakRss,
+    /// GPU frame time on the production paint path. Device-bound.
+    FrameTime,
+}
+
+impl Metric {
+    /// The axis this metric is tracked on (Spec 06 §5 / D1).
+    #[must_use]
+    pub fn axis(self) -> Axis {
+        match self {
+            Metric::AllocBytes | Metric::AllocBlocks | Metric::OpCount | Metric::RenderCost => {
+                Axis::Portable
+            }
+            Metric::WallTime | Metric::PeakRss | Metric::FrameTime => Axis::DeviceBound,
+        }
+    }
+
+    /// `true` when this metric can be captured headless in the agent environment.
+    #[must_use]
+    pub fn is_agent_runnable(self) -> bool {
+        self.axis().is_agent_runnable()
+    }
+}
+
+#[cfg(test)]
+#[path = "axis_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/axis_tests.rs b/loki-bench/src/axis_tests.rs
new file mode 100644
index 00000000..a995f731
--- /dev/null
+++ b/loki-bench/src/axis_tests.rs
@@ -0,0 +1,46 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! The two-axis split (Spec 06 §5) and the per-metric mapping (D1), verified
+//! without a window or a GPU.
+
+use super::*;
+
+#[test]
+fn portable_is_agent_runnable_and_device_is_not() {
+    assert!(Axis::Portable.is_agent_runnable());
+    assert!(!Axis::Portable.is_hardware_only());
+    assert!(Axis::DeviceBound.is_hardware_only());
+    assert!(!Axis::DeviceBound.is_agent_runnable());
+}
+
+#[test]
+fn axis_slugs_are_stable() {
+    assert_eq!(Axis::Portable.slug(), "portable");
+    assert_eq!(Axis::DeviceBound.slug(), "device");
+}
+
+#[test]
+fn allocation_and_op_metrics_are_portable() {
+    // D1: allocation bytes/counts are the portable, continuously-tracked signal.
+    for m in [
+        Metric::AllocBytes,
+        Metric::AllocBlocks,
+        Metric::OpCount,
+        Metric::RenderCost,
+    ] {
+        assert_eq!(m.axis(), Axis::Portable, "{m:?} must be portable");
+        assert!(m.is_agent_runnable(), "{m:?} must run headless");
+    }
+}
+
+#[test]
+fn timing_rss_and_frame_time_are_device_bound() {
+    for m in [Metric::WallTime, Metric::PeakRss, Metric::FrameTime] {
+        assert_eq!(m.axis(), Axis::DeviceBound, "{m:?} must be device-bound");
+        assert!(
+            !m.is_agent_runnable(),
+            "{m:?} must not run in the agent env"
+        );
+    }
+}
diff --git a/loki-bench/src/baseline.rs b/loki-bench/src/baseline.rs
new file mode 100644
index 00000000..c11a18d6
--- /dev/null
+++ b/loki-bench/src/baseline.rs
@@ -0,0 +1,300 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Committed baseline + diff for continuous memory tracking (Spec 06 M3 / §7 / §11).
+//!
+//! A curated set of portable allocation metrics is rendered to a committed text
+//! file (one line per key), diffed against on each run, and updated *only
+//! intentionally*. Allocation counts barely move run-to-run, so a real
+//! regression stands out well past the jitter tolerance — including the headline
+//! case (audit §4): a shared resource cloned by value instead of by `Arc` turns a
+//! near-zero metric into a large one, which the diff flags as **Regressed**.
+//!
+//! This module is pure and headless (no workload deps); the bench that collects
+//! the samples and reads/writes the file is `benches/baseline.rs`.
+
+use std::collections::BTreeMap;
+
+use crate::AllocStats;
+
+/// Relative tolerances below which a change is treated as noise (Unchanged).
+///
+/// Counts are near-deterministic; byte totals drift a little (e.g. DOCX zip
+/// ordering), so bytes get more slack. A real regression dwarfs both.
+#[derive(Clone, Copy, Debug)]
+pub struct Tolerance {
+    /// Fractional slack on `total_bytes` (e.g. `0.05` = 5%).
+    pub bytes_frac: f64,
+    /// Fractional slack on `total_blocks` (allocation count).
+    pub blocks_frac: f64,
+}
+
+impl Default for Tolerance {
+    fn default() -> Self {
+        Self {
+            bytes_frac: 0.05,
+            blocks_frac: 0.02,
+        }
+    }
+}
+
+/// A committed baseline: key → metrics, ordered for a stable, diff-friendly file.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Baseline {
+    entries: BTreeMap<String, AllocStats>,
+}
+
+impl Baseline {
+    /// Builds a baseline from collected `(key, stats)` samples.
+    #[must_use]
+    pub fn from_samples(samples: &[(String, AllocStats)]) -> Self {
+        Self {
+            entries: samples.iter().cloned().collect(),
+        }
+    }
+
+    /// The metrics recorded for `key`, if any.
+    #[must_use]
+    pub fn get(&self, key: &str) -> Option<AllocStats> {
+        self.entries.get(key).copied()
+    }
+
+    /// The recorded keys, in sorted order.
+    pub fn keys(&self) -> impl Iterator<Item = &String> {
+        self.entries.keys()
+    }
+
+    /// Number of recorded keys.
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.entries.len()
+    }
+
+    /// Whether the baseline has no entries.
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.entries.is_empty()
+    }
+
+    /// Renders the baseline as a stable, comment-headed, column-aligned file.
+    #[must_use]
+    pub fn render(&self) -> String {
+        let mut out = String::new();
+        out.push_str("# loki-bench portable memory baseline (Spec 06 M3).\n");
+        out.push_str(
+            "# Update intentionally: cargo bench -p loki-bench --bench baseline -- --update\n",
+        );
+        out.push_str("# key  total_bytes  total_blocks  max_bytes  max_blocks\n");
+        for (k, s) in &self.entries {
+            out.push_str(&format!(
+                "{k:<40} {:>12} {:>10} {:>12} {:>10}\n",
+                s.total_bytes, s.total_blocks, s.max_bytes, s.max_blocks,
+            ));
+        }
+        out
+    }
+
+    /// Parses the text format, ignoring blank and `#` comment lines.
+    ///
+    /// # Errors
+    /// [`BaselineError`] on a line without five fields or a non-integer metric.
+    pub fn parse(text: &str) -> Result<Self, BaselineError> {
+        let mut entries = BTreeMap::new();
+        for (i, raw) in text.lines().enumerate() {
+            let line = raw.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            let f: Vec<&str> = line.split_whitespace().collect();
+            if f.len() != 5 {
+                return Err(BaselineError::Fields {
+                    line: i + 1,
+                    found: line.to_string(),
+                });
+            }
+            let num = |idx: usize, field: &'static str| -> Result<u64, BaselineError> {
+                f[idx].parse::<u64>().map_err(|_| BaselineError::Int {
+                    line: i + 1,
+                    field,
+                    value: f[idx].to_string(),
+                })
+            };
+            entries.insert(
+                f[0].to_string(),
+                AllocStats {
+                    total_bytes: num(1, "total_bytes")?,
+                    total_blocks: num(2, "total_blocks")?,
+                    max_bytes: num(3, "max_bytes")?,
+                    max_blocks: num(4, "max_blocks")?,
+                },
+            );
+        }
+        Ok(Self { entries })
+    }
+}
+
+/// A malformed committed baseline file.
+#[derive(Debug, thiserror::Error)]
+pub enum BaselineError {
+    /// A data line did not have exactly five fields.
+    #[error(
+        "baseline line {line}: expected `key bytes blocks max_bytes max_blocks`, got {found:?}"
+    )]
+    Fields {
+        /// 1-based line number.
+        line: usize,
+        /// The offending line.
+        found: String,
+    },
+    /// A metric field was not a valid unsigned integer.
+    #[error("baseline line {line}: invalid integer in {field}: {value:?}")]
+    Int {
+        /// 1-based line number.
+        line: usize,
+        /// Which column failed to parse.
+        field: &'static str,
+        /// The offending token.
+        value: String,
+    },
+}
+
+/// How a key's metrics moved relative to the baseline.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DeltaStatus {
+    /// Present now, absent from the baseline.
+    New,
+    /// Present in the baseline, absent now.
+    Removed,
+    /// Grew beyond tolerance — the flag for review.
+    Regressed,
+    /// Shrank beyond tolerance.
+    Improved,
+    /// Within tolerance either way.
+    Unchanged,
+}
+
+/// One key's comparison between the current run and the baseline.
+pub struct Delta {
+    /// The metric key.
+    pub key: String,
+    /// The movement classification.
+    pub status: DeltaStatus,
+    /// The baseline metrics, if the key was present there.
+    pub baseline: Option<AllocStats>,
+    /// The current metrics, if the key was present now.
+    pub current: Option<AllocStats>,
+    /// Relative change in `total_bytes` (`+INF` when the baseline was zero).
+    pub bytes_pct: f64,
+    /// Relative change in `total_blocks`.
+    pub blocks_pct: f64,
+}
+
+/// Diffs the current samples against the baseline, classifying each key.
+#[must_use]
+pub fn diff(current: &[(String, AllocStats)], baseline: &Baseline, tol: Tolerance) -> Vec<Delta> {
+    let cur_keys: BTreeMap<&str, AllocStats> =
+        current.iter().map(|(k, s)| (k.as_str(), *s)).collect();
+    let mut deltas = Vec::new();
+
+    for (k, s) in current {
+        match baseline.get(k) {
+            Some(base) => {
+                let bytes_pct = rel(s.total_bytes, base.total_bytes);
+                let blocks_pct = rel(s.total_blocks, base.total_blocks);
+                deltas.push(Delta {
+                    key: k.clone(),
+                    status: classify(bytes_pct, blocks_pct, tol),
+                    baseline: Some(base),
+                    current: Some(*s),
+                    bytes_pct,
+                    blocks_pct,
+                });
+            }
+            None => deltas.push(Delta {
+                key: k.clone(),
+                status: DeltaStatus::New,
+                baseline: None,
+                current: Some(*s),
+                bytes_pct: 0.0,
+                blocks_pct: 0.0,
+            }),
+        }
+    }
+
+    for k in baseline.keys() {
+        if !cur_keys.contains_key(k.as_str()) {
+            deltas.push(Delta {
+                key: k.clone(),
+                status: DeltaStatus::Removed,
+                baseline: baseline.get(k),
+                current: None,
+                bytes_pct: 0.0,
+                blocks_pct: 0.0,
+            });
+        }
+    }
+
+    deltas.sort_by(|a, b| a.key.cmp(&b.key));
+    deltas
+}
+
+/// `true` when any key regressed — the signal a reviewer acts on (never a CI
+/// failure; §11).
+#[must_use]
+pub fn any_regressed(deltas: &[Delta]) -> bool {
+    deltas.iter().any(|d| d.status == DeltaStatus::Regressed)
+}
+
+/// Renders a one-line-per-key review report.
+#[must_use]
+pub fn render_report(deltas: &[Delta]) -> String {
+    let mut out = String::new();
+    for d in deltas {
+        let tag = match d.status {
+            DeltaStatus::New => "NEW",
+            DeltaStatus::Removed => "REMOVED",
+            DeltaStatus::Regressed => "REGRESSED",
+            DeltaStatus::Improved => "improved",
+            DeltaStatus::Unchanged => "ok",
+        };
+        out.push_str(&format!(
+            "  [{tag:<9}] {:<40} bytes {}  allocs {}\n",
+            d.key,
+            fmt_pct(d.bytes_pct),
+            fmt_pct(d.blocks_pct),
+        ));
+    }
+    out
+}
+
+/// Relative change `(cur - base) / base`, with `+INF` when the baseline was zero
+/// and something now allocates — the Arc-share-regressed case.
+fn rel(cur: u64, base: u64) -> f64 {
+    if base == 0 {
+        if cur == 0 { 0.0 } else { f64::INFINITY }
+    } else {
+        (cur as f64 - base as f64) / base as f64
+    }
+}
+
+fn classify(bytes_pct: f64, blocks_pct: f64, tol: Tolerance) -> DeltaStatus {
+    if bytes_pct > tol.bytes_frac || blocks_pct > tol.blocks_frac {
+        DeltaStatus::Regressed
+    } else if bytes_pct < -tol.bytes_frac || blocks_pct < -tol.blocks_frac {
+        DeltaStatus::Improved
+    } else {
+        DeltaStatus::Unchanged
+    }
+}
+
+fn fmt_pct(p: f64) -> String {
+    if p.is_finite() {
+        format!("{:+.1}%", p * 100.0)
+    } else {
+        "  new-alloc".to_string()
+    }
+}
+
+#[cfg(test)]
+#[path = "baseline_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/baseline_tests.rs b/loki-bench/src/baseline_tests.rs
new file mode 100644
index 00000000..fe007aa9
--- /dev/null
+++ b/loki-bench/src/baseline_tests.rs
@@ -0,0 +1,89 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Baseline round-trip + diff classification (Spec 06 M3). The headline check is
+//! that a deliberate regression — including a shared resource cloned by value
+//! instead of by `Arc` (a near-zero metric turning large) — is flagged
+//! `Regressed`.
+
+use super::*;
+
+fn stats(bytes: u64, blocks: u64) -> AllocStats {
+    AllocStats {
+        total_bytes: bytes,
+        total_blocks: blocks,
+        max_bytes: bytes,
+        max_blocks: blocks,
+    }
+}
+
+#[test]
+fn render_then_parse_round_trips() {
+    let base = Baseline::from_samples(&[
+        ("layout/medium".to_string(), stats(9_737_350, 14_325)),
+        ("arc/share_font_resources".to_string(), stats(0, 0)),
+    ]);
+    let parsed = Baseline::parse(&base.render()).expect("parse");
+    assert_eq!(parsed, base);
+}
+
+#[test]
+fn parse_ignores_comments_and_blank_lines() {
+    let text = "# header\n\n  # indented comment\nlayout/small 100 5 80 4\n";
+    let b = Baseline::parse(text).expect("parse");
+    assert_eq!(b.len(), 1);
+    assert_eq!(b.get("layout/small").map(|s| s.total_blocks), Some(5));
+}
+
+#[test]
+fn parse_rejects_malformed_lines() {
+    assert!(Baseline::parse("key 1 2 3\n").is_err()); // 4 fields, need 5
+    assert!(Baseline::parse("key x 2 3 4\n").is_err()); // non-integer
+}
+
+#[test]
+fn a_deliberate_growth_regression_is_flagged() {
+    let base = Baseline::from_samples(&[("layout/medium".to_string(), stats(1_000_000, 10_000))]);
+    // Same key now allocates ~2x — a real regression, far past tolerance.
+    let current = vec![("layout/medium".to_string(), stats(2_000_000, 20_000))];
+    let deltas = diff(&current, &base, Tolerance::default());
+    assert_eq!(deltas[0].status, DeltaStatus::Regressed);
+    assert!(any_regressed(&deltas));
+}
+
+#[test]
+fn arc_share_replaced_by_value_clone_is_flagged() {
+    // The acceptance case: the shared-Arc metric is 0 allocations in the
+    // baseline; a value-clone regression makes it allocate, which must flag.
+    let base = Baseline::from_samples(&[("arc/share_font_resources".to_string(), stats(0, 0))]);
+    let current = vec![("arc/share_font_resources".to_string(), stats(20_000_000, 1))];
+    let deltas = diff(&current, &base, Tolerance::default());
+    assert_eq!(deltas[0].status, DeltaStatus::Regressed);
+    assert!(!deltas[0].bytes_pct.is_finite(), "0 -> nonzero is +INF");
+}
+
+#[test]
+fn within_tolerance_jitter_is_unchanged() {
+    // DOCX byte drift of a few dozen bytes on ~2 MB is well within tolerance.
+    let base = Baseline::from_samples(&[("io/medium_save".to_string(), stats(2_186_331, 720))]);
+    let current = vec![("io/medium_save".to_string(), stats(2_186_362, 720))];
+    let deltas = diff(&current, &base, Tolerance::default());
+    assert_eq!(deltas[0].status, DeltaStatus::Unchanged);
+}
+
+#[test]
+fn improvement_and_new_and_removed_are_classified() {
+    let base = Baseline::from_samples(&[
+        ("keep".to_string(), stats(1_000_000, 10_000)),
+        ("gone".to_string(), stats(500, 5)),
+    ]);
+    let current = vec![
+        ("keep".to_string(), stats(500_000, 5_000)), // halved → improved
+        ("fresh".to_string(), stats(100, 2)),        // not in baseline → new
+    ];
+    let deltas = diff(&current, &base, Tolerance::default());
+    let by = |k: &str| deltas.iter().find(|d| d.key == k).map(|d| d.status);
+    assert_eq!(by("keep"), Some(DeltaStatus::Improved));
+    assert_eq!(by("fresh"), Some(DeltaStatus::New));
+    assert_eq!(by("gone"), Some(DeltaStatus::Removed));
+}
diff --git a/loki-bench/src/budget.rs b/loki-bench/src/budget.rs
new file mode 100644
index 00000000..7036f003
--- /dev/null
+++ b/loki-bench/src/budget.rs
@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Per-tier peak-RSS budgets (Spec 06 M5 / §9, decision D2).
+//!
+//! A budget is a **review target, never a gate** (§11): a measurement over budget
+//! prompts a look, not a build failure. Budgets are *calibrated* — set from
+//! measured behaviour plus headroom against the 8 GB floor, not guessed — and
+//! committed alongside the calibration record so they trace to data.
+
+use std::collections::BTreeMap;
+
+/// Whether a measured peak RSS is within its tier budget.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum BudgetStatus {
+    /// At or under budget.
+    WithinBudget,
+    /// Over budget — review.
+    OverBudget,
+}
+
+/// Compares a measured peak RSS (bytes) against a tier budget (bytes).
+#[must_use]
+pub fn check(measured_bytes: u64, budget_bytes: u64) -> BudgetStatus {
+    if measured_bytes <= budget_bytes {
+        BudgetStatus::WithinBudget
+    } else {
+        BudgetStatus::OverBudget
+    }
+}
+
+/// Headroom remaining under budget as a fraction of the budget (negative when
+/// over). `0.0` for a zero budget.
+#[must_use]
+pub fn headroom_frac(measured_bytes: u64, budget_bytes: u64) -> f64 {
+    if budget_bytes == 0 {
+        return 0.0;
+    }
+    (budget_bytes as f64 - measured_bytes as f64) / budget_bytes as f64
+}
+
+/// Committed per-tier peak-RSS budgets: tier → budget bytes.
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct Budgets {
+    entries: BTreeMap<String, u64>,
+}
+
+impl Budgets {
+    /// Builds budgets from `(tier, budget_bytes)` pairs.
+    #[must_use]
+    pub fn from_pairs(pairs: &[(String, u64)]) -> Self {
+        Self {
+            entries: pairs.iter().cloned().collect(),
+        }
+    }
+
+    /// The budget for `tier`, if set.
+    #[must_use]
+    pub fn get(&self, tier: &str) -> Option<u64> {
+        self.entries.get(tier).copied()
+    }
+
+    /// Renders a stable, comment-headed `tier  budget_bytes` file.
+    #[must_use]
+    pub fn render(&self) -> String {
+        let mut out = String::new();
+        out.push_str("# loki-bench per-tier peak-RSS budgets (Spec 06 M5 / §9, bytes).\n");
+        out.push_str(
+            "# Review targets, not gates. Recalibrate on device: see spec-06-calibration.md\n",
+        );
+        out.push_str("# tier  budget_bytes\n");
+        for (tier, bytes) in &self.entries {
+            out.push_str(&format!("{tier:<24} {bytes:>14}\n"));
+        }
+        out
+    }
+
+    /// Parses the `tier  budget_bytes` format, ignoring blank / `#` lines.
+    ///
+    /// # Errors
+    /// Returns the 1-based line number of the first malformed line.
+    pub fn parse(text: &str) -> Result<Self, usize> {
+        let mut entries = BTreeMap::new();
+        for (i, raw) in text.lines().enumerate() {
+            let line = raw.trim();
+            if line.is_empty() || line.starts_with('#') {
+                continue;
+            }
+            let mut f = line.split_whitespace();
+            let (Some(tier), Some(bytes), None) = (f.next(), f.next(), f.next()) else {
+                return Err(i + 1);
+            };
+            let bytes: u64 = bytes.parse().map_err(|_| i + 1)?;
+            entries.insert(tier.to_string(), bytes);
+        }
+        Ok(Self { entries })
+    }
+}
+
+#[cfg(test)]
+#[path = "budget_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/budget_tests.rs b/loki-bench/src/budget_tests.rs
new file mode 100644
index 00000000..844c4877
--- /dev/null
+++ b/loki-bench/src/budget_tests.rs
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Per-tier peak-RSS budget checks + budgets-file round-trip (Spec 06 M5).
+
+use super::*;
+
+#[test]
+fn within_and_over_budget() {
+    assert_eq!(check(500, 1_000), BudgetStatus::WithinBudget);
+    assert_eq!(check(1_000, 1_000), BudgetStatus::WithinBudget); // boundary is within
+    assert_eq!(check(1_001, 1_000), BudgetStatus::OverBudget);
+}
+
+#[test]
+fn headroom_is_signed_fraction_of_budget() {
+    assert!((headroom_frac(500, 1_000) - 0.5).abs() < 1e-9);
+    assert!(headroom_frac(1_500, 1_000) < 0.0); // over budget → negative
+    assert_eq!(headroom_frac(10, 0), 0.0);
+}
+
+#[test]
+fn budgets_render_then_parse_round_trips() {
+    let b = Budgets::from_pairs(&[
+        ("large".to_string(), 900_000_000),
+        ("small".to_string(), 300_000_000),
+    ]);
+    assert_eq!(Budgets::parse(&b.render()).expect("parse"), b);
+    assert_eq!(b.get("large"), Some(900_000_000));
+    assert_eq!(b.get("missing"), None);
+}
+
+#[test]
+fn budgets_parse_rejects_malformed_lines() {
+    assert!(Budgets::parse("small 100 extra\n").is_err()); // 3 fields
+    assert!(Budgets::parse("small notanumber\n").is_err());
+}
diff --git a/loki-bench/src/leak.rs b/loki-bench/src/leak.rs
new file mode 100644
index 00000000..9f99abb8
--- /dev/null
+++ b/loki-bench/src/leak.rs
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Leak detection (Spec 06 M4 / §7): residual live-heap measurement plus a pure
+//! verdict on whether that residual *scales with repetitions* (a leak) or stays
+//! flat (bounded).
+//!
+//! Where [`measure`](crate::measure) reports the cumulative allocation of a
+//! region, leak detection watches the **live heap still held after** a
+//! open→edit→close cycle. Run the cycle once and again N times: if the residual
+//! is flat, nothing leaked; if it grows ~linearly with N, a document was
+//! retained (an `Arc` cycle) or a cache never evicted — the §7 culprits.
+//!
+//! The residual measurement needs dhat's global allocator (installed in the bench
+//! binary via [`dhat_global_allocator!`](crate::dhat_global_allocator)); the
+//! [`classify_leak`] verdict is pure and unit-tested.
+
+/// Live heap still allocated when a measured region returns — the leak signal.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub struct ResidualStats {
+    /// Bytes allocated during the region that are still live at its end.
+    pub curr_bytes: u64,
+    /// Allocations during the region still live at its end.
+    pub curr_blocks: u64,
+}
+
+/// Runs `cycle` `reps` times under a dhat session and returns the heap still live
+/// afterward. A leak-free cycle leaves a flat residual as `reps` grows; a leak
+/// grows it ~linearly. Returns a zeroed residual if the dhat allocator is not
+/// installed (the bench binary must opt in).
+pub fn residual_after<F: FnMut()>(reps: usize, mut cycle: F) -> ResidualStats {
+    let _profiler = dhat::Profiler::builder().testing().build();
+    for _ in 0..reps {
+        cycle();
+    }
+    let stats = dhat::HeapStats::get();
+    ResidualStats {
+        curr_bytes: stats.curr_bytes as u64,
+        curr_blocks: stats.curr_blocks as u64,
+    }
+}
+
+/// Whether residual heap scaled with repetitions (a leak) or stayed bounded.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum LeakVerdict {
+    /// Residual stayed within the bounded envelope — no per-cycle leak.
+    Bounded,
+    /// Residual grew past the envelope — retained work accumulates.
+    Leaking,
+}
+
+impl LeakVerdict {
+    /// `true` for [`LeakVerdict::Leaking`].
+    #[must_use]
+    pub fn leaks(self) -> bool {
+        self == LeakVerdict::Leaking
+    }
+}
+
+/// Classifies a leak from residual live bytes at a low and a high repetition
+/// count.
+///
+/// `baseline` is the residual after few cycles (one-time init + one cycle's
+/// worth); `scaled` is the residual after many. Bounded work keeps `scaled`
+/// within `slack_bytes` of `baseline` (the one-time cost is paid once either
+/// way); a leak makes `scaled` climb with the repetition count, well past
+/// `slack_bytes`.
+#[must_use]
+pub fn classify_leak(baseline: u64, scaled: u64, slack_bytes: u64) -> LeakVerdict {
+    if scaled > baseline.saturating_add(slack_bytes) {
+        LeakVerdict::Leaking
+    } else {
+        LeakVerdict::Bounded
+    }
+}
+
+#[cfg(test)]
+#[path = "leak_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/leak_tests.rs b/loki-bench/src/leak_tests.rs
new file mode 100644
index 00000000..e33f8287
--- /dev/null
+++ b/loki-bench/src/leak_tests.rs
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Leak classifier (Spec 06 M4). The residual measurement needs a live allocator
+//! (exercised by the `leak_*` benches); the verdict logic is pure and tested here.
+
+use super::*;
+
+const SLACK: u64 = 64 * 1024; // 64 KiB one-time/noise envelope.
+
+#[test]
+fn flat_residual_is_bounded() {
+    // A clean open/edit/close leaves ~0 net either way.
+    assert_eq!(classify_leak(0, 0, SLACK), LeakVerdict::Bounded);
+    // One-time init paid once → within slack.
+    assert_eq!(classify_leak(20_000, 25_000, SLACK), LeakVerdict::Bounded);
+}
+
+#[test]
+fn residual_scaling_with_reps_is_a_leak() {
+    // A retained document per cycle: 1 doc vs 64 docs of live heap.
+    let one_doc = 500_000;
+    let sixty_four_docs = 64 * 500_000;
+    assert_eq!(
+        classify_leak(one_doc, sixty_four_docs, SLACK),
+        LeakVerdict::Leaking,
+    );
+    assert!(classify_leak(one_doc, sixty_four_docs, SLACK).leaks());
+}
+
+#[test]
+fn growth_just_past_slack_is_flagged() {
+    assert_eq!(
+        classify_leak(1_000, 1_000 + SLACK, SLACK),
+        LeakVerdict::Bounded
+    );
+    assert_eq!(
+        classify_leak(1_000, 1_000 + SLACK + 1, SLACK),
+        LeakVerdict::Leaking,
+    );
+}
+
+#[test]
+fn default_residual_is_zero() {
+    assert_eq!(
+        ResidualStats::default(),
+        ResidualStats {
+            curr_bytes: 0,
+            curr_blocks: 0
+        }
+    );
+}
diff --git a/loki-bench/src/lib.rs b/loki-bench/src/lib.rs
new file mode 100644
index 00000000..b9975ea7
--- /dev/null
+++ b/loki-bench/src/lib.rs
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+#![forbid(unsafe_code)]
+
+//! Shared benchmarking & continuous-memory-tracking harness for the AppThere
+//! Loki suite (Spec 06). Lives at the monorepo root alongside the Spec 01/02
+//! shared infrastructure so Text, Presentation, and Spreadsheet can all bench.
+//!
+//! # The two axes (Spec 06 §5)
+//!
+//! Every bench is sorted onto exactly one [`Axis`], because *where it can run*
+//! and *how trustworthy its number is* differ sharply:
+//!
+//! - [`Axis::Portable`] — heap allocation bytes/counts (dhat), model/layout/IO/
+//!   style op counts, `vello_cpu` render cost. Hardware-independent, so it runs
+//!   headless in the agent environment with **no GPU**, and its numbers are
+//!   diffable across machines and over time. This is what makes memory
+//!   *continuously trackable* (decision D1).
+//! - [`Axis::DeviceBound`] — GPU frame-time, wall-clock latency, real peak RSS.
+//!   Varies by CPU/GPU/driver, so it runs **only on real hardware** and is a
+//!   local reference point, never a tracked cross-machine signal.
+//!
+//! [`Metric`] pins each measurement to its axis, encoding the §5 table directly:
+//! allocation bytes/counts are Portable; RSS and frame-time are DeviceBound.
+//!
+//! # Memory measurement
+//!
+//! [`measure`] runs a workload under a dhat heap-profiling session and returns
+//! the portable [`AllocStats`] it produced. dhat only records when its global
+//! allocator is installed in the running binary, so a bench binary opts in with
+//! [`dhat_global_allocator!`] at its top. See `benches/portable_alloc.rs`.
+//!
+//! # Status (Spec 06 M1)
+//!
+//! This is the **harness skeleton + two-axis split**: the axis/metric model, the
+//! dhat allocation-measurement path, and Criterion wired via the `benches/`
+//! targets. The per-target portable benches (M2), the committed baseline + diff
+//! (M3), leak detection (M4), and the device benches + budgets (M5) build on it.
+
+mod axis;
+mod baseline;
+mod budget;
+mod leak;
+mod memory;
+mod parity;
+mod rss;
+
+pub use axis::{Axis, Metric};
+pub use baseline::{
+    Baseline, BaselineError, Delta, DeltaStatus, Tolerance, any_regressed, diff, render_report,
+};
+pub use budget::{BudgetStatus, Budgets, check, headroom_frac};
+pub use leak::{LeakVerdict, ResidualStats, classify_leak, residual_after};
+pub use memory::{AllocStats, measure};
+pub use parity::{
+    ParityStatus, confirmed_version_from_marker, parity_status, render_marker,
+    vello_version_from_lock,
+};
+pub use rss::{current_rss_bytes, parse_status_kib, peak_rss_bytes};
+
+/// Re-exported so [`dhat_global_allocator!`] can name `dhat` from any bench
+/// binary without that binary declaring a direct `dhat` dependency.
+pub use dhat;
+
+/// Installs dhat's global allocator in the current binary so [`measure`] records
+/// real allocations. Place it once at the top of a bench/binary crate root:
+///
+/// ```ignore
+/// loki_bench::dhat_global_allocator!();
+///
+/// fn main() {
+///     let stats = loki_bench::measure(|| { /* portable workload */ });
+///     eprintln!("{} bytes / {} allocs", stats.total_bytes, stats.total_blocks);
+/// }
+/// ```
+///
+/// Without it dhat records nothing and [`measure`] returns zeroed stats — the
+/// harness still runs, it just has no memory signal, so opting in is required.
+#[macro_export]
+macro_rules! dhat_global_allocator {
+    () => {
+        #[global_allocator]
+        static LOKI_BENCH_DHAT_ALLOC: $crate::dhat::Alloc = $crate::dhat::Alloc;
+    };
+}
diff --git a/loki-bench/src/memory.rs b/loki-bench/src/memory.rs
new file mode 100644
index 00000000..c6e6a8f6
--- /dev/null
+++ b/loki-bench/src/memory.rs
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Portable heap-allocation measurement (Spec 06 §5/§7, decision D1).
+
+/// Portable heap-allocation metrics for a measured region, captured with dhat.
+///
+/// Bytes and block counts barely move across machines, so they are the primary
+/// *continuously tracked* memory signal — diffable across machines and over time,
+/// unlike wall-clock or RSS (decision D1). Serializable derives land with the
+/// committed baseline in M3; M1 keeps the type dependency-light.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Default)]
+pub struct AllocStats {
+    /// Total bytes allocated over the region (cumulative, not net).
+    pub total_bytes: u64,
+    /// Total number of allocations over the region (cumulative).
+    pub total_blocks: u64,
+    /// Peak live bytes at any instant during the region.
+    pub max_bytes: u64,
+    /// Peak live allocations at any instant during the region.
+    pub max_blocks: u64,
+}
+
+/// Runs `workload` under a dhat heap-profiling session and returns the portable
+/// [`AllocStats`] it produced.
+///
+/// **Requires the dhat global allocator** to be installed in the running binary
+/// via [`crate::dhat_global_allocator!`]. Without it dhat records nothing and the
+/// returned stats are all zero — the harness still runs, it just has no signal,
+/// so bench binaries must opt in.
+///
+/// The dhat profiler is process-global and testing-mode allows only one at a
+/// time, so `measure` builds and drops its own session per call; sequential calls
+/// are therefore safe, concurrent ones are not.
+pub fn measure<F: FnOnce()>(workload: F) -> AllocStats {
+    let _profiler = dhat::Profiler::builder().testing().build();
+    workload();
+    let stats = dhat::HeapStats::get();
+    AllocStats {
+        total_bytes: stats.total_bytes,
+        total_blocks: stats.total_blocks,
+        // dhat reports the live-peak fields as `usize`; widen to the stable u64
+        // the baseline (M3) will serialize. usize -> u64 never truncates.
+        max_bytes: stats.max_bytes as u64,
+        max_blocks: stats.max_blocks as u64,
+    }
+}
+
+#[cfg(test)]
+#[path = "memory_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/memory_tests.rs b/loki-bench/src/memory_tests.rs
new file mode 100644
index 00000000..409dd0a6
--- /dev/null
+++ b/loki-bench/src/memory_tests.rs
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! The dhat allocation-measurement plumbing (Spec 06 §5/§7). Verified without
+//! the global allocator installed, so it asserts the invariants that hold either
+//! way; the nonzero-signal proof is the `portable_alloc` bench, which opts in.
+
+use super::*;
+
+#[test]
+fn measure_runs_the_workload_and_returns_well_formed_stats() {
+    let mut ran = false;
+    let stats = measure(|| {
+        let v: Vec<u64> = (0..256).collect();
+        std::hint::black_box(&v);
+        ran = true;
+    });
+    assert!(ran, "measure must run the workload exactly once");
+    // dhat invariant: live peak never exceeds the cumulative total — true whether
+    // or not the global allocator is installed (0 <= 0 when it is not).
+    assert!(stats.max_bytes <= stats.total_bytes);
+    assert!(stats.max_blocks <= stats.total_blocks);
+}
diff --git a/loki-bench/src/parity.rs b/loki-bench/src/parity.rs
new file mode 100644
index 00000000..d5dfd71b
--- /dev/null
+++ b/loki-bench/src/parity.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! CPU/GPU render-parity cadence (Spec 06 M6 / §12, decision D5).
+//!
+//! Spec 02 renders conformance goldens on `vello_cpu` while the app paints on GPU
+//! `vello`; the two pinned crates can drift as they version forward, so the parity
+//! check (same scene both ways, expected to agree within tolerance) must run **on
+//! every Vello version bump** and on a regular local cadence, on GPU hardware.
+//!
+//! The parity *check itself* needs a GPU and Spec 02's `vello_cpu` render path
+//! (audit BM-3), so it runs on-device. This module makes the **version-bump
+//! trigger** mechanical and headless: it compares the currently pinned Vello
+//! version (from `Cargo.lock`) against the version the parity check was last
+//! *confirmed* against (a committed marker), so a bump is a detectable, actionable
+//! signal — not something to remember.
+
+/// Whether the CPU/GPU parity check is due to run.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ParityStatus {
+    /// The pinned Vello version matches the last confirmed parity run.
+    UpToDate,
+    /// The Vello version changed since the last confirmed run — re-run on GPU.
+    Due {
+        /// The version the check was last confirmed against.
+        last: String,
+        /// The currently pinned version.
+        current: String,
+    },
+    /// No confirmed run is on record yet (marker missing/empty).
+    NeverRun {
+        /// The currently pinned version.
+        current: String,
+    },
+}
+
+impl ParityStatus {
+    /// `true` when the parity check should be run (bumped or never run).
+    #[must_use]
+    pub fn is_due(&self) -> bool {
+        !matches!(self, ParityStatus::UpToDate)
+    }
+}
+
+/// Compares the currently pinned Vello version to the last-confirmed marker.
+#[must_use]
+pub fn parity_status(current_vello: &str, confirmed: Option<&str>) -> ParityStatus {
+    match confirmed {
+        None => ParityStatus::NeverRun {
+            current: current_vello.to_string(),
+        },
+        Some(c) if c == current_vello => ParityStatus::UpToDate,
+        Some(c) => ParityStatus::Due {
+            last: c.to_string(),
+            current: current_vello.to_string(),
+        },
+    }
+}
+
+/// Extracts the exact `vello` crate version from `Cargo.lock` text — the version
+/// of the `[[package]]` whose `name = "vello"` (never `vello_cpu` etc.).
+#[must_use]
+pub fn vello_version_from_lock(cargo_lock: &str) -> Option<String> {
+    let mut in_vello = false;
+    for raw in cargo_lock.lines() {
+        let line = raw.trim();
+        if line == "[[package]]" {
+            in_vello = false;
+        } else if line == "name = \"vello\"" {
+            in_vello = true;
+        } else if in_vello && let Some(v) = line.strip_prefix("version = ") {
+            return Some(v.trim_matches('"').to_string());
+        }
+    }
+    None
+}
+
+/// Reads the confirmed Vello version from a parity marker file's text (the first
+/// non-comment `vello_version <ver>` line). Comment (`#`) and blank lines ignored.
+#[must_use]
+pub fn confirmed_version_from_marker(marker: &str) -> Option<String> {
+    for raw in marker.lines() {
+        let line = raw.trim();
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+        if let Some(rest) = line.strip_prefix("vello_version") {
+            return rest.split_whitespace().next().map(str::to_string);
+        }
+    }
+    None
+}
+
+/// Renders a parity marker recording `version` as the confirmed Vello version.
+#[must_use]
+pub fn render_marker(version: &str) -> String {
+    format!(
+        "# loki-bench CPU/GPU parity cadence marker (Spec 06 M6 / §12).\n\
+         # The Vello version the parity check was last CONFIRMED against on GPU\n\
+         # hardware. Update ONLY after a successful on-device parity run\n\
+         # (see docs/adr/spec-06-discipline.md); note the date/device/tolerance below.\n\
+         vello_version {version}\n\
+         # last confirmed: <date, device, tolerance> — maintained by hand on commit\n"
+    )
+}
+
+#[cfg(test)]
+#[path = "parity_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/parity_tests.rs b/loki-bench/src/parity_tests.rs
new file mode 100644
index 00000000..a75a792f
--- /dev/null
+++ b/loki-bench/src/parity_tests.rs
@@ -0,0 +1,74 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! CPU/GPU parity cadence trigger (Spec 06 M6 / §12): Vello-version extraction
+//! and the bump-detection verdict. Pure and headless.
+
+use super::*;
+
+const LOCK: &str = "\
+[[package]]
+name = \"vello_cpu\"
+version = \"9.9.9\"
+
+[[package]]
+name = \"vello\"
+version = \"0.6.0\"
+
+[[package]]
+name = \"vello_encoding\"
+version = \"0.6.0\"
+";
+
+#[test]
+fn extracts_exact_vello_version_not_a_sibling_crate() {
+    assert_eq!(vello_version_from_lock(LOCK).as_deref(), Some("0.6.0"));
+}
+
+#[test]
+fn missing_vello_is_none() {
+    assert_eq!(
+        vello_version_from_lock("[[package]]\nname = \"loro\"\n"),
+        None
+    );
+}
+
+#[test]
+fn marker_round_trips() {
+    let m = render_marker("0.6.0");
+    assert_eq!(confirmed_version_from_marker(&m).as_deref(), Some("0.6.0"));
+}
+
+#[test]
+fn same_version_is_up_to_date() {
+    assert_eq!(
+        parity_status("0.6.0", Some("0.6.0")),
+        ParityStatus::UpToDate
+    );
+    assert!(!parity_status("0.6.0", Some("0.6.0")).is_due());
+}
+
+#[test]
+fn a_version_bump_is_due() {
+    let s = parity_status("0.7.0", Some("0.6.0"));
+    assert_eq!(
+        s,
+        ParityStatus::Due {
+            last: "0.6.0".to_string(),
+            current: "0.7.0".to_string(),
+        }
+    );
+    assert!(s.is_due());
+}
+
+#[test]
+fn no_marker_means_never_run() {
+    let s = parity_status("0.6.0", None);
+    assert_eq!(
+        s,
+        ParityStatus::NeverRun {
+            current: "0.6.0".to_string()
+        }
+    );
+    assert!(s.is_due());
+}
diff --git a/loki-bench/src/rss.rs b/loki-bench/src/rss.rs
new file mode 100644
index 00000000..0dbb28c5
--- /dev/null
+++ b/loki-bench/src/rss.rs
@@ -0,0 +1,58 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! OS-level resident-set-size measurement (Spec 06 M5 / §10) — the device-bound
+//! memory reality check that complements the portable allocation signal (D1).
+//!
+//! The *number* is machine-specific, but the Linux mechanism (`/proc/self/status`)
+//! runs anywhere with `/proc`, so it is verifiable headless. The macOS / Windows
+//! readers (`getrusage` `ru_maxrss` / `GetProcessMemoryInfo`) are the on-device
+//! follow-up for Kevin's MacBook A16 and Windows box — they need platform FFI
+//! this `forbid(unsafe_code)` crate leaves to the device build, and cannot be
+//! exercised in the agent regardless.
+
+/// Peak resident set size (high-water mark) of this process, in bytes.
+///
+/// `None` when the platform has no reader yet (currently everything but Linux).
+#[must_use]
+pub fn peak_rss_bytes() -> Option<u64> {
+    read_status_kib("VmHWM").map(|kib| kib * 1024)
+}
+
+/// Current resident set size of this process, in bytes. `None` off Linux.
+#[must_use]
+pub fn current_rss_bytes() -> Option<u64> {
+    read_status_kib("VmRSS").map(|kib| kib * 1024)
+}
+
+#[cfg(target_os = "linux")]
+fn read_status_kib(key: &str) -> Option<u64> {
+    let status = std::fs::read_to_string("/proc/self/status").ok()?;
+    parse_status_kib(&status, key)
+}
+
+#[cfg(not(target_os = "linux"))]
+fn read_status_kib(_key: &str) -> Option<u64> {
+    None // macOS/Windows plumbing is the on-device task (Spec 06 M5 §10).
+}
+
+/// Parses a `/proc/self/status` line like `VmHWM:\t 1952 kB`, returning the KiB
+/// value for `key`. Pure, so it is unit-tested without `/proc`.
+#[must_use]
+pub fn parse_status_kib(status: &str, key: &str) -> Option<u64> {
+    for line in status.lines() {
+        if let Some(rest) = line.strip_prefix(key) {
+            let rest = rest.trim_start();
+            if !rest.starts_with(':') {
+                continue; // e.g. `key` is a prefix of a different field name
+            }
+            let value = rest.trim_start_matches(':').trim();
+            return value.split_whitespace().next()?.parse::<u64>().ok();
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+#[path = "rss_tests.rs"]
+mod tests;
diff --git a/loki-bench/src/rss_tests.rs b/loki-bench/src/rss_tests.rs
new file mode 100644
index 00000000..b207de7b
--- /dev/null
+++ b/loki-bench/src/rss_tests.rs
@@ -0,0 +1,33 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! `/proc/self/status` parsing (Spec 06 M5). Pure and headless; the live reader
+//! is exercised by the `device_rss` bench.
+
+use super::*;
+
+const SAMPLE: &str = "\
+Name:\tloki-bench
+VmPeak:\t 3548 kB
+VmHWM:\t 1952 kB
+VmRSS:\t 1952 kB
+Threads:\t 1
+";
+
+#[test]
+fn parses_peak_and_current() {
+    assert_eq!(parse_status_kib(SAMPLE, "VmHWM"), Some(1952));
+    assert_eq!(parse_status_kib(SAMPLE, "VmRSS"), Some(1952));
+    assert_eq!(parse_status_kib(SAMPLE, "VmPeak"), Some(3548));
+}
+
+#[test]
+fn missing_key_is_none() {
+    assert_eq!(parse_status_kib(SAMPLE, "VmSwap"), None);
+}
+
+#[test]
+fn prefix_collision_is_not_a_false_match() {
+    // "Vm" is a prefix of several fields but must not match on its own.
+    assert_eq!(parse_status_kib(SAMPLE, "Vm"), None);
+}
diff --git a/loki-doc-model/src/content/table/core.rs b/loki-doc-model/src/content/table/core.rs
index bc8c789d..6974bfac 100644
--- a/loki-doc-model/src/content/table/core.rs
+++ b/loki-doc-model/src/content/table/core.rs
@@ -155,6 +155,37 @@ impl Table {
     pub fn col_count(&self) -> usize {
         self.col_specs.len()
     }
+
+    /// Builds a `rows` × `cols` table of empty paragraph cells with evenly
+    /// proportioned columns — the shape the editor's Insert → Table control
+    /// creates. Each cell holds one empty `Block::Para` so it is immediately
+    /// editable via a `BlockPath`. `rows` and `cols` are clamped to at least 1.
+    #[must_use]
+    pub fn grid(rows: usize, cols: usize) -> Self {
+        use crate::content::block::Block;
+        use crate::content::table::row::{Cell, Row};
+        let rows = rows.max(1);
+        let cols = cols.max(1);
+        let col_specs = (0..cols).map(|_| ColSpec::proportional(1.0)).collect();
+        let body_rows = (0..rows)
+            .map(|_| {
+                Row::new(
+                    (0..cols)
+                        .map(|_| Cell::simple(vec![Block::Para(Vec::new())]))
+                        .collect(),
+                )
+            })
+            .collect();
+        Self {
+            attr: NodeAttr::default(),
+            caption: TableCaption::default(),
+            width: None,
+            col_specs,
+            head: TableHead::empty(),
+            bodies: vec![TableBody::from_rows(body_rows)],
+            foot: TableFoot::empty(),
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/loki-doc-model/src/lib.rs b/loki-doc-model/src/lib.rs
index d889e0d9..bc649ecd 100644
--- a/loki-doc-model/src/lib.rs
+++ b/loki-doc-model/src/lib.rs
@@ -148,10 +148,19 @@ pub use loro_schema::*;
 pub mod loro_bridge;
 pub use loro_bridge::{BridgeError, IncrementalReader, document_to_loro, loro_to_document};
 pub mod loro_mutation;
+pub use loro_mutation::{
+    BlockPath, PathStep, delete_text_at, get_block_text_at, get_mark_at_path, insert_text_at,
+    mark_text_at,
+};
 pub use loro_mutation::{
     MutationError, delete_text, get_block_alignment, get_block_style_name, get_block_text,
-    get_mark_at, insert_text, mark_text, merge_block, replace_text, set_block_alignment,
-    set_block_style, set_block_type_heading, set_block_type_para, split_block,
+    get_mark_at, insert_text, mark_text, merge_block, merge_block_at, replace_text,
+    set_block_alignment, set_block_style, set_block_type_heading, set_block_type_para, split_block,
+    split_block_at,
+};
+#[cfg(feature = "serde")]
+pub use loro_mutation::{
+    insert_block_after, insert_inline_image, insert_inline_image_at, insert_inline_note_at,
 };
 pub mod error;
 pub mod io;
@@ -171,7 +180,7 @@ pub use content::attr::{ExtensionBag, ExtensionKey, NodeAttr};
 pub use content::{Block, Inline};
 pub use layout::Section;
 pub use meta::DocumentMeta;
-pub use style::{StyleCatalog, StyleId};
+pub use style::{Provenance, Resolved, StyleCatalog, StyleId};
 
 /// Derive-macro re-exports (serde support is feature-gated).
 #[cfg(feature = "serde")]
diff --git a/loki-doc-model/src/loro_bridge/inline_objects.rs b/loki-doc-model/src/loro_bridge/inline_objects.rs
new file mode 100644
index 00000000..893d1495
--- /dev/null
+++ b/loki-doc-model/src/loro_bridge/inline_objects.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Write helpers for structured inline objects anchored in a paragraph's text.
+//!
+//! Each object is anchored by a single [`OBJECT_REPLACEMENT_CHAR`] in the
+//! block's `LoroText`, carrying a mark that identifies it:
+//!
+//! - **Image** ([`MARK_IMAGE`]): the whole `Inline::Image` as a `serde`-JSON
+//!   snapshot in the mark (its bytes/geometry are small and immutable).
+//! - **Note** ([`MARK_NOTE`]): a `(kind, idx)` pair in the mark, with the body
+//!   stored as a **live CRDT container** under the block's [`KEY_NOTES`] list at
+//!   `idx` — so footnote text is editable/mergeable, not a JSON blob.
+//!
+//! Split out of `inlines.rs` to keep that file under the 300-line ceiling.
+//! Reconstructed by `inlines_read::reconstruct_inlines`.
+
+use super::BridgeError;
+use crate::content::block::Block;
+use crate::content::inline::{Inline, NoteKind};
+use crate::loro_schema::{KEY_NOTES, MARK_NOTE, OBJECT_REPLACEMENT_STR};
+use loro::{LoroMap, LoroMovableList, LoroText};
+
+/// Writes a self-contained inline object (currently [`Inline::Image`]) as an
+/// anchor whose `serde`-JSON snapshot is stored in `mark_key`
+/// (e.g. [`MARK_IMAGE`][crate::loro_schema::MARK_IMAGE]).
+pub(super) fn write_inline_object(
+    inline: &Inline,
+    text: &LoroText,
+    mark_key: &str,
+) -> Result<(), BridgeError> {
+    match serde_json::to_string(inline) {
+        Ok(json) => {
+            let start = text.len_unicode();
+            text.insert(start, OBJECT_REPLACEMENT_STR)?;
+            let end = text.len_unicode();
+            text.mark(start..end, mark_key, json)?;
+        }
+        Err(err) => {
+            // Unreachable in practice: `Inline` derives Serialize. Drop the
+            // object rather than leave a bare anchor with no backing data.
+            tracing::warn!("loro bridge: failed to encode inline object ({mark_key}): {err}");
+        }
+    }
+    Ok(())
+}
+
+/// Writes a footnote/endnote: an [`OBJECT_REPLACEMENT_CHAR`] anchor marked with
+/// a `(kind, idx)` pair, plus the **body** as a live container at `idx` in the
+/// block's [`KEY_NOTES`] list. The `idx` also keeps adjacent notes' marks
+/// distinct so their anchors do not merge into one rich-text span.
+pub(super) fn write_note(
+    kind: &NoteKind,
+    body: &[Block],
+    text: &LoroText,
+    block_map: &LoroMap,
+) -> Result<(), BridgeError> {
+    let notes = get_or_create_notes_list(block_map)?;
+    let idx = notes.len();
+
+    let start = text.len_unicode();
+    text.insert(start, OBJECT_REPLACEMENT_STR)?;
+    let end = text.len_unicode();
+    let meta =
+        serde_json::to_string(&(kind, idx)).unwrap_or_else(|_| String::from("[\"Footnote\",0]"));
+    text.mark(start..end, MARK_NOTE, meta)?;
+
+    let body_list = notes.insert_container(idx, LoroMovableList::new())?;
+    super::write::map_blocks_to_list(body, &body_list)?;
+    Ok(())
+}
+
+/// Inserts a note (footnote/endnote) anchor at UTF-8 `byte_offset` in `text` —
+/// the mutation-time analog of [`write_note`], which appends at the text end.
+/// The `(kind, idx)` mark and the live body container at `idx` under
+/// [`KEY_NOTES`] follow the same schema, so the inserted note round-trips and
+/// its body is an editable container reachable via a `BlockPath`.
+#[cfg(feature = "serde")]
+pub(crate) fn insert_note_at(
+    text: &LoroText,
+    block_map: &LoroMap,
+    byte_offset: usize,
+    kind: &NoteKind,
+    body: &[Block],
+) -> Result<(), BridgeError> {
+    let notes = get_or_create_notes_list(block_map)?;
+    let idx = notes.len();
+    text.insert_utf8(byte_offset, OBJECT_REPLACEMENT_STR)?;
+    let end = byte_offset + OBJECT_REPLACEMENT_STR.len();
+    let meta =
+        serde_json::to_string(&(kind, idx)).unwrap_or_else(|_| String::from("[\"Footnote\",0]"));
+    text.mark_utf8(byte_offset..end, MARK_NOTE, meta)?;
+    let body_list = notes.insert_container(idx, LoroMovableList::new())?;
+    super::write::map_blocks_to_list(body, &body_list)?;
+    Ok(())
+}
+
+/// Returns the block's [`KEY_NOTES`] movable list, creating it if absent.
+fn get_or_create_notes_list(block_map: &LoroMap) -> Result<LoroMovableList, BridgeError> {
+    if let Some(list) = block_map
+        .get(KEY_NOTES)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok())
+    {
+        Ok(list)
+    } else {
+        Ok(block_map.insert_container(KEY_NOTES, LoroMovableList::new())?)
+    }
+}
diff --git a/loki-doc-model/src/loro_bridge/inlines.rs b/loki-doc-model/src/loro_bridge/inlines.rs
index 9c338c53..2369158f 100644
--- a/loki-doc-model/src/loro_bridge/inlines.rs
+++ b/loki-doc-model/src/loro_bridge/inlines.rs
@@ -10,7 +10,7 @@ use super::BridgeError;
 use crate::content::inline::Inline;
 use crate::loro_schema::*;
 use crate::style::props::char_props::CharProps;
-use loro::LoroText;
+use loro::{LoroMap, LoroText};
 
 // ── Serialization ─────────────────────────────────────────────────────────────
 
@@ -25,7 +25,15 @@ fn insert_inline_text(text: &LoroText, inlines: &[Inline]) -> Result<(usize, usi
     Ok((start, text.len_unicode()))
 }
 
-pub(super) fn map_inlines(inlines: &[Inline], text: &LoroText) -> Result<(), BridgeError> {
+/// Serializes `inlines` into `text`. `block_map` is the owning block's map, used
+/// to store live side-containers (currently footnote/endnote bodies under
+/// [`KEY_NOTES`]).
+pub(super) fn map_inlines(
+    inlines: &[Inline],
+    text: &LoroText,
+    block_map: &LoroMap,
+) -> Result<(), BridgeError> {
+    let _ = block_map; // used only by the serde-gated Note arm below
     for inline in inlines {
         let start = text.len_unicode();
         match inline {
@@ -97,6 +105,19 @@ pub(super) fn map_inlines(inlines: &[Inline], text: &LoroText) -> Result<(), Bri
                     text.mark(start..end, MARK_LINK_URL, target.url.as_str())?;
                 }
             }
+            // Inline objects anchored natively (placeholder char + data mark) so
+            // they stay live, positioned, deletable inlines. Only *top-level*
+            // objects reach here — one nested in a wrapper keeps its block
+            // opaque (see `opaque.rs`). Without `serde` they fall through to the
+            // catch-all and their block is preserved opaquely instead.
+            #[cfg(feature = "serde")]
+            Inline::Image(..) => {
+                super::inline_objects::write_inline_object(inline, text, MARK_IMAGE)?;
+            }
+            #[cfg(feature = "serde")]
+            Inline::Note(kind, body) => {
+                super::inline_objects::write_note(kind, body, text, block_map)?;
+            }
             // Text-bearing wrappers without a dedicated mark: keep the text.
             // Quote type / span attrs / citation metadata are not yet carried
             // through the CRDT — TODO(loro-bridge).
diff --git a/loki-doc-model/src/loro_bridge/inlines_read.rs b/loki-doc-model/src/loro_bridge/inlines_read.rs
index aa2a3dd0..ac688476 100644
--- a/loki-doc-model/src/loro_bridge/inlines_read.rs
+++ b/loki-doc-model/src/loro_bridge/inlines_read.rs
@@ -32,11 +32,29 @@ pub(super) fn reconstruct_inlines(map: &loro::LoroMap) -> Result<Vec<Inline>, Br
         return Ok(inlines);
     };
 
+    // Live footnote/endnote bodies live in a side-container on the block map.
+    let notes_list = map
+        .get(KEY_NOTES)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok());
+
     for span in text_container.to_delta() {
         if let loro::TextDelta::Insert { insert, attributes } = span {
             match attributes {
                 None => inlines.push(Inline::Str(insert.to_string())),
                 Some(attrs) => {
+                    // An inline object (anchored by a placeholder char) carries
+                    // its data in a mark — reconstruct it and discard the
+                    // placeholder character itself. Image data rides in the
+                    // mark; a note's body is fetched from the notes container.
+                    if let Some(image) = decode_image(&attrs) {
+                        inlines.push(image);
+                        continue;
+                    }
+                    if let Some(note) = decode_note(&attrs, notes_list.as_ref()) {
+                        inlines.push(note);
+                        continue;
+                    }
                     let props = read_char_props_from_marks(&attrs);
                     let style_id = read_style_id_from_marks(&attrs);
                     if props.is_some() || style_id.is_some() {
@@ -57,6 +75,60 @@ pub(super) fn reconstruct_inlines(map: &loro::LoroMap) -> Result<Vec<Inline>, Br
     Ok(inlines)
 }
 
+/// Reconstructs an [`Inline::Image`] from a [`MARK_IMAGE`] anchor's `serde`-JSON
+/// snapshot, if present. Returns `None` for ordinary formatted text.
+#[cfg(feature = "serde")]
+fn decode_image(attrs: &rustc_hash::FxHashMap<String, LoroValue>) -> Option<Inline> {
+    let Some(LoroValue::String(json)) = attrs.get(MARK_IMAGE) else {
+        return None;
+    };
+    match serde_json::from_str::<Inline>(json) {
+        Ok(inline @ Inline::Image(..)) => Some(inline),
+        Ok(_) => {
+            tracing::warn!("loro bridge: MARK_IMAGE snapshot was not an image");
+            None
+        }
+        Err(err) => {
+            tracing::warn!("loro bridge: failed to decode inline image: {err}");
+            None
+        }
+    }
+}
+
+/// Reconstructs an [`Inline::Note`] from a [`MARK_NOTE`] anchor: its `(kind,
+/// idx)` mark plus the body fetched from `notes` at `idx` (a live container).
+#[cfg(feature = "serde")]
+fn decode_note(
+    attrs: &rustc_hash::FxHashMap<String, LoroValue>,
+    notes: Option<&loro::LoroMovableList>,
+) -> Option<Inline> {
+    use crate::content::inline::NoteKind;
+    let Some(LoroValue::String(meta)) = attrs.get(MARK_NOTE) else {
+        return None;
+    };
+    let (kind, idx): (NoteKind, usize) = serde_json::from_str(meta).ok()?;
+    let body = notes
+        .and_then(|l| l.get(idx))
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok())
+        .map(|l| super::read::reconstruct_blocks_from_list(&l))
+        .unwrap_or_default();
+    Some(Inline::Note(kind, body))
+}
+
+#[cfg(not(feature = "serde"))]
+fn decode_image(_attrs: &rustc_hash::FxHashMap<String, LoroValue>) -> Option<Inline> {
+    None
+}
+
+#[cfg(not(feature = "serde"))]
+fn decode_note(
+    _attrs: &rustc_hash::FxHashMap<String, LoroValue>,
+    _notes: Option<&loro::LoroMovableList>,
+) -> Option<Inline> {
+    None
+}
+
 /// Reads the named character style carried by [`MARK_CHAR_STYLE_ID`].
 fn read_style_id_from_marks(attrs: &rustc_hash::FxHashMap<String, LoroValue>) -> Option<StyleId> {
     if let Some(LoroValue::String(s)) = attrs.get(MARK_CHAR_STYLE_ID) {
diff --git a/loki-doc-model/src/loro_bridge/mod.rs b/loki-doc-model/src/loro_bridge/mod.rs
index df1f2960..1722f4ee 100644
--- a/loki-doc-model/src/loro_bridge/mod.rs
+++ b/loki-doc-model/src/loro_bridge/mod.rs
@@ -12,6 +12,8 @@
 mod comments;
 mod decode;
 mod incremental;
+#[cfg(feature = "serde")]
+mod inline_objects;
 mod inlines;
 mod inlines_read;
 mod meta;
@@ -19,6 +21,7 @@ mod opaque;
 mod props_read;
 mod read;
 mod styles;
+mod table;
 mod write;
 
 pub use comments::{read_document_comments, write_document_comments};
@@ -26,6 +29,13 @@ pub use incremental::IncrementalReader;
 pub use meta::{read_document_meta, write_document_meta};
 pub use styles::{read_document_styles, write_document_styles};
 
+// Crate-internal block / note writers reused by the mutation layer to insert a
+// new `Block` or footnote against a live document (same schema as the initial
+// `document_to_loro`).
+#[cfg(feature = "serde")]
+pub(crate) use inline_objects::insert_note_at;
+pub(crate) use write::map_block;
+
 use crate::document::Document;
 use crate::layout::header_footer::HeaderFooter;
 use crate::layout::page::{PageLayout, PageOrientation};
@@ -116,32 +126,11 @@ fn map_header_footer_slot(
 pub fn document_to_loro(doc: &Document) -> Result<LoroDoc, BridgeError> {
     let loro_doc = LoroDoc::new();
 
-    // Register all mark keys so Loro tracks their expand behaviour.
+    // Register every mark key so Loro tracks its expand behaviour.
     let mut style_config = StyleConfigMap::new();
-    for key in &[
-        MARK_BOLD,
-        MARK_ITALIC,
-        MARK_UNDERLINE,
-        MARK_STRIKETHROUGH,
-        MARK_COLOR,
-        MARK_HIGHLIGHT_COLOR,
-        MARK_FONT_FAMILY,
-        MARK_FONT_SIZE_PT,
-        MARK_VERTICAL_ALIGN,
-        MARK_LINK_URL,
-        MARK_LANGUAGE,
-        MARK_LANGUAGE_COMPLEX,
-        MARK_LANGUAGE_EAST_ASIAN,
-        MARK_LETTER_SPACING,
-        MARK_WORD_SPACING,
-        MARK_SCALE,
-        MARK_SMALL_CAPS,
-        MARK_ALL_CAPS,
-        MARK_SHADOW,
-        MARK_KERNING,
-        MARK_OUTLINE,
-        MARK_CHAR_STYLE_ID,
-    ] {
+    // Character formatting marks expand onto text inserted at their trailing
+    // edge (`After`) — the single source of truth is `CHAR_MARK_KEYS`.
+    for key in CHAR_MARK_KEYS {
         style_config.insert(
             loro::InternalString::from(*key),
             StyleConfig {
@@ -149,6 +138,16 @@ pub fn document_to_loro(doc: &Document) -> Result<LoroDoc, BridgeError> {
             },
         );
     }
+    // Inline-object anchor marks must not expand onto adjacent text — they
+    // describe a single placeholder position, not a formatting span.
+    for key in INLINE_OBJECT_MARK_KEYS {
+        style_config.insert(
+            loro::InternalString::from(*key),
+            StyleConfig {
+                expand: ExpandType::None,
+            },
+        );
+    }
     loro_doc.config_text_style(style_config);
 
     // Metadata — full DocumentMeta (core + Dublin Core) as a lossless snapshot.
diff --git a/loki-doc-model/src/loro_bridge/opaque.rs b/loki-doc-model/src/loro_bridge/opaque.rs
index d9fae7ee..b19ef809 100644
--- a/loki-doc-model/src/loro_bridge/opaque.rs
+++ b/loki-doc-model/src/loro_bridge/opaque.rs
@@ -4,10 +4,10 @@
 //! Opaque-snapshot preservation for blocks the Loro schema cannot represent.
 //!
 //! The CRDT schema flattens paragraph content into a [`loro::LoroText`] with
-//! marks, which cannot carry structured content (tables, lists, figures,
-//! footnote bodies, inline images, fields, math). Before this module existed,
-//! such blocks were written as empty stubs and read back as
-//! `Block::HorizontalRule` — i.e. a single edit cycle destroyed them.
+//! marks, which cannot carry most structured content (lists, figures, footnote
+//! bodies, fields, math; tables have their own native mapping in `table.rs`).
+//! Before this module existed, such blocks were written as empty stubs and read
+//! back as `Block::HorizontalRule` — i.e. a single edit cycle destroyed them.
 //!
 //! Instead, any block that cannot round-trip through the text schema is
 //! serialized to JSON (via the model's `serde` derives) and stored verbatim
@@ -15,6 +15,16 @@
 //! original [`Block`]. Opaque blocks render normally but are not
 //! collaboratively editable from within; converting them to native CRDT
 //! mappings is tracked as TODO(loro-bridge) work.
+//!
+//! Inline objects are migrating off this fallback one variant at a time. A
+//! *top-level* inline image ([`MARK_IMAGE`][crate::loro_schema::MARK_IMAGE]) or
+//! footnote/endnote ([`MARK_NOTE`][crate::loro_schema::MARK_NOTE]) is now mapped
+//! natively — an
+//! [`OBJECT_REPLACEMENT_CHAR`][crate::loro_schema::OBJECT_REPLACEMENT_CHAR]
+//! anchor carries the object as a mark — so it stays a live, positioned,
+//! deletable inline (see `inlines::write_inline_object`). The same object
+//! *nested* inside a wrapper or run is flattened by the text write path, so its
+//! block still takes the opaque path.
 
 use super::BridgeError;
 use crate::content::block::Block;
@@ -35,7 +45,28 @@ pub(super) fn block_round_trips_as_text(block: &Block) -> bool {
 }
 
 fn inlines_round_trip(inlines: &[Inline]) -> bool {
-    inlines.iter().all(|inline| match inline {
+    inlines.iter().all(inline_round_trips_top)
+}
+
+/// Top-level inline (a direct child of the paragraph's inline list).
+///
+/// A bare image or footnote/endnote here is mapped natively by the write path —
+/// an [`OBJECT_REPLACEMENT_CHAR`][crate::loro_schema::OBJECT_REPLACEMENT_CHAR]
+/// anchor carrying the object as a mark — so the paragraph stays live-editable
+/// instead of collapsing to an opaque snapshot. This requires `serde` (the
+/// snapshot format); without it the object is not representable.
+fn inline_round_trips_top(inline: &Inline) -> bool {
+    match inline {
+        Inline::Image(..) | Inline::Note(..) => cfg!(feature = "serde"),
+        other => inline_round_trips_nested(other),
+    }
+}
+
+/// Inline nested inside a wrapper or styled run. The write path flattens these
+/// to plain text, so any structured object here (including a nested image)
+/// cannot survive natively and forces the whole block to an opaque snapshot.
+fn inline_round_trips_nested(inline: &Inline) -> bool {
+    match inline {
         Inline::Str(_)
         | Inline::Space
         | Inline::SoftBreak
@@ -50,18 +81,19 @@ fn inlines_round_trip(inlines: &[Inline]) -> bool {
         | Inline::SmallCaps(inner)
         | Inline::Quoted(_, inner)
         | Inline::Span(_, inner)
-        | Inline::Link(_, inner, _) => inlines_round_trip(inner),
-        Inline::StyledRun(run) => inlines_round_trip(&run.content),
+        | Inline::Link(_, inner, _) => inner.iter().all(inline_round_trips_nested),
+        Inline::StyledRun(run) => run.content.iter().all(inline_round_trips_nested),
         // Comment and bookmark anchors carry no body text and have always
         // been dropped by the text flattening; treating them as representable
         // keeps the vast majority of paragraphs editable.
         // TODO(loro-bridge): preserve comment/bookmark anchors as marks.
         Inline::Comment(_) | Inline::Bookmark(_, _) => true,
-        // Note (footnote/endnote bodies), Image, Field, Math, RawInline,
-        // Cite — structured content the flat text cannot carry. The whole
-        // containing block is preserved as an opaque snapshot instead.
+        // Nested Note/Image, Field, Math, RawInline, Cite — structured content
+        // the flat text cannot carry (and, when nested, the native anchor path
+        // does not reach it). The whole containing block is preserved as an
+        // opaque snapshot instead.
         _ => false,
-    })
+    }
 }
 
 /// Writes `block` into `map` as an opaque JSON snapshot.
diff --git a/loki-doc-model/src/loro_bridge/read.rs b/loki-doc-model/src/loro_bridge/read.rs
index b3eca0bc..71966c05 100644
--- a/loki-doc-model/src/loro_bridge/read.rs
+++ b/loki-doc-model/src/loro_bridge/read.rs
@@ -81,12 +81,12 @@ pub(super) fn map_loro_block(map: &LoroMap) -> Result<Block, BridgeError> {
         }
         BLOCK_TYPE_HR => Ok(Block::HorizontalRule),
         BLOCK_TYPE_OPAQUE => Ok(super::opaque::read_opaque_block(map)),
+        // Native table mapping (skeleton + live per-cell block lists). A legacy
+        // stub written before this mapping has no skeleton and falls back to a
+        // rule inside `read_table`.
+        BLOCK_TYPE_TABLE => Ok(super::table::read_table(map)),
         // Legacy stubs: blocks written by bridge versions that predate the
         // opaque-snapshot scheme carry no content and cannot be recovered.
-        BLOCK_TYPE_TABLE => {
-            tracing::debug!("TODO/stub: loro bridge table");
-            Ok(Block::HorizontalRule)
-        }
         BLOCK_TYPE_BULLET_LIST => {
             tracing::debug!("TODO/stub: loro bridge bullet list");
             Ok(Block::HorizontalRule)
diff --git a/loki-doc-model/src/loro_bridge/table.rs b/loki-doc-model/src/loro_bridge/table.rs
new file mode 100644
index 00000000..fc78a89b
--- /dev/null
+++ b/loki-doc-model/src/loro_bridge/table.rs
@@ -0,0 +1,136 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Native CRDT mapping for `Block::Table`.
+//!
+//! A table is stored as two parts so it round-trips losslessly *and* its cell
+//! text becomes live, mergeable CRDT state rather than one opaque JSON blob:
+//!
+//! - **Skeleton** ([`KEY_TABLE_SKELETON`]): a `serde`-JSON snapshot of the whole
+//!   [`Table`] with every cell's blocks emptied. This carries the structural
+//!   metadata — column specs/widths, section/row layout, row/column spans, cell
+//!   and row properties, borders, caption, and node attributes.
+//! - **Cell contents** ([`KEY_TABLE_CELLS`]): a movable list with one entry per
+//!   cell, each a movable list of that cell's blocks written through the shared
+//!   block path ([`map_blocks_to_list`]). Cell text therefore lives in real
+//!   `LoroText` containers, so concurrent edits to different cells merge.
+//!
+//! The two parts are joined by a single deterministic traversal order
+//! ([`cells_in_order`] / [`cells_in_order_mut`]) — the i-th cell-content list
+//! fills the i-th cell of the skeleton. Both functions MUST visit cells in the
+//! same order; keep them in sync.
+//!
+//! Structural edits (adding a row, changing a span) still rewrite the skeleton
+//! blob and so do not merge at that granularity; a fully structural CRDT
+//! mapping is future TODO(loro-bridge) work. Without the `serde` feature the
+//! table has no skeleton format, so it falls back to the opaque path.
+
+use super::BridgeError;
+use crate::content::block::Block;
+use crate::content::table::core::Table;
+use crate::content::table::row::Cell;
+use crate::loro_schema::{BLOCK_TYPE_TABLE, KEY_TABLE_CELLS, KEY_TABLE_SKELETON, KEY_TYPE};
+use loro::{LoroMap, LoroMovableList};
+
+/// Visits every cell once, in head → bodies (head rows then body rows) → foot,
+/// row-major order. The write/read paths share this order to pair each cell
+/// with its content list.
+fn cells_in_order(table: &Table) -> impl Iterator<Item = &Cell> {
+    let head = table.head.rows.iter();
+    let bodies = table
+        .bodies
+        .iter()
+        .flat_map(|b| b.head_rows.iter().chain(b.body_rows.iter()));
+    let foot = table.foot.rows.iter();
+    head.chain(bodies)
+        .chain(foot)
+        .flat_map(|row| row.cells.iter())
+}
+
+/// Mutable twin of [`cells_in_order`] — MUST visit cells in the identical order.
+fn cells_in_order_mut(table: &mut Table) -> impl Iterator<Item = &mut Cell> {
+    let head = table.head.rows.iter_mut();
+    let bodies = table
+        .bodies
+        .iter_mut()
+        .flat_map(|b| b.head_rows.iter_mut().chain(b.body_rows.iter_mut()));
+    let foot = table.foot.rows.iter_mut();
+    head.chain(bodies)
+        .chain(foot)
+        .flat_map(|row| row.cells.iter_mut())
+}
+
+/// Writes `table` into `map` as a native [`BLOCK_TYPE_TABLE`] block.
+#[cfg(feature = "serde")]
+pub(super) fn write_table(table: &Table, map: &LoroMap) -> Result<(), BridgeError> {
+    map.insert(KEY_TYPE, BLOCK_TYPE_TABLE)?;
+
+    // Skeleton: the whole table with cell blocks stripped out.
+    let mut skeleton = table.clone();
+    for cell in cells_in_order_mut(&mut skeleton) {
+        cell.blocks = Vec::new();
+    }
+    match serde_json::to_string(&skeleton) {
+        Ok(json) => {
+            map.insert(KEY_TABLE_SKELETON, json)?;
+        }
+        Err(err) => {
+            // Unreachable in practice: every Table field derives Serialize.
+            tracing::warn!("loro bridge: failed to snapshot table skeleton: {err}");
+        }
+    }
+
+    // Live cell contents, one nested block list per cell (shared block path).
+    let cells_list = map.insert_container(KEY_TABLE_CELLS, LoroMovableList::new())?;
+    for (i, cell) in cells_in_order(table).enumerate() {
+        let cell_blocks = cells_list.insert_container(i, LoroMovableList::new())?;
+        super::write::map_blocks_to_list(&cell.blocks, &cell_blocks)?;
+    }
+    Ok(())
+}
+
+/// Reads a native [`BLOCK_TYPE_TABLE`] block back into a [`Block::Table`].
+///
+/// Falls back to [`Block::HorizontalRule`] when the skeleton is missing or
+/// unparseable (e.g. a legacy stub, or a table written without `serde`).
+pub(super) fn read_table(map: &LoroMap) -> Block {
+    match read_table_inner(map) {
+        Some(table) => Block::Table(Box::new(table)),
+        None => {
+            tracing::warn!("loro bridge: unreadable native table; dropping to rule");
+            Block::HorizontalRule
+        }
+    }
+}
+
+#[cfg(feature = "serde")]
+fn read_table_inner(map: &LoroMap) -> Option<Table> {
+    let json = map
+        .get(KEY_TABLE_SKELETON)
+        .and_then(|v| v.into_value().ok())
+        .and_then(|v| v.into_string().ok())
+        .map(|s| s.to_string())?;
+    let mut table: Table = serde_json::from_str(&json).ok()?;
+
+    let cells_list = map
+        .get(KEY_TABLE_CELLS)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok());
+    if let Some(cells_list) = cells_list {
+        for (i, cell) in cells_in_order_mut(&mut table).enumerate() {
+            if let Some(list) = cells_list
+                .get(i)
+                .and_then(|v| v.into_container().ok())
+                .and_then(|c| c.into_movable_list().ok())
+            {
+                cell.blocks = super::read::reconstruct_blocks_from_list(&list);
+            }
+        }
+    }
+    Some(table)
+}
+
+#[cfg(not(feature = "serde"))]
+fn read_table_inner(_map: &LoroMap) -> Option<Table> {
+    None
+}
diff --git a/loki-doc-model/src/loro_bridge/write.rs b/loki-doc-model/src/loro_bridge/write.rs
index d16cc044..4f827949 100644
--- a/loki-doc-model/src/loro_bridge/write.rs
+++ b/loki-doc-model/src/loro_bridge/write.rs
@@ -14,7 +14,14 @@ use loro::{LoroMap, LoroMovableList, LoroText};
 
 // ── Block serialization ───────────────────────────────────────────────────────
 
-pub(super) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError> {
+pub(crate) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError> {
+    // Tables have a native mapping: a structural skeleton plus live per-cell
+    // block lists (see `table.rs`). Without `serde` there is no skeleton
+    // format, so the table takes the opaque path below instead.
+    #[cfg(feature = "serde")]
+    if let Block::Table(table) = block {
+        return super::table::write_table(table, map);
+    }
     // Blocks (or paragraphs whose inline content) the flat text schema cannot
     // represent are preserved verbatim as opaque JSON snapshots so that a
     // document_to_loro → loro_to_document round-trip is lossless. See
@@ -26,7 +33,7 @@ pub(super) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError>
         Block::Para(inlines) => {
             map.insert(KEY_TYPE, BLOCK_TYPE_PARA)?;
             let content = map.insert_container(KEY_CONTENT, LoroText::new())?;
-            map_inlines(inlines, &content)?;
+            map_inlines(inlines, &content, map)?;
         }
         Block::StyledPara(para) => {
             map.insert(KEY_TYPE, BLOCK_TYPE_STYLED_PARA)?;
@@ -42,7 +49,7 @@ pub(super) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError>
                 map_char_props_to_map(char_props, &props_map)?;
             }
             let content = map.insert_container(KEY_CONTENT, LoroText::new())?;
-            map_inlines(&para.inlines, &content)?;
+            map_inlines(&para.inlines, &content, map)?;
         }
         Block::Heading(level, attr, inlines) => {
             map.insert(KEY_TYPE, BLOCK_TYPE_HEADING)?;
@@ -56,7 +63,7 @@ pub(super) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError>
                 map.insert(KEY_HEADING_STYLE, style.as_str())?;
             }
             let content = map.insert_container(KEY_CONTENT, LoroText::new())?;
-            map_inlines(inlines, &content)?;
+            map_inlines(inlines, &content, map)?;
         }
         Block::CodeBlock(_, content_str) => {
             map.insert(KEY_TYPE, BLOCK_TYPE_CODE_BLOCK)?;
@@ -69,7 +76,7 @@ pub(super) fn map_block(block: &Block, map: &LoroMap) -> Result<(), BridgeError>
         Block::Plain(inlines) => {
             map.insert(KEY_TYPE, BLOCK_TYPE_PARA)?;
             let content = map.insert_container(KEY_CONTENT, LoroText::new())?;
-            map_inlines(inlines, &content)?;
+            map_inlines(inlines, &content, map)?;
         }
         // All structurally unsupported variants (lists, tables, figures,
         // blockquotes, …) take the opaque-snapshot early return above; this
diff --git a/loki-doc-model/src/loro_mutation/block.rs b/loki-doc-model/src/loro_mutation/block.rs
index 34ff4b85..b37dd8d1 100644
--- a/loki-doc-model/src/loro_mutation/block.rs
+++ b/loki-doc-model/src/loro_mutation/block.rs
@@ -1,16 +1,19 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2026 AppThere Loki contributors
 
-//! Block-level structural mutations: split and merge.
+//! Block-level structural mutations: split, merge, and insert.
 
-use loro::{LoroDoc, LoroMap, LoroText};
+#[cfg(feature = "serde")]
+use crate::content::block::Block;
+use loro::{LoroDoc, LoroMap, LoroMovableList, LoroText};
 
 use crate::loro_schema::{
     KEY_CONTENT, KEY_DIRECT_CHAR_PROPS, KEY_HEADING_LEVEL, KEY_PARA_PROPS, KEY_TYPE,
 };
 
+use super::nested::resolve_block_list;
 use super::{
-    MutationError, copy_map_primitive_values, get_block_map_and_list, get_loro_text_for_block,
+    BlockPath, MutationError, copy_map_primitive_values, get_block_map_and_list,
     resolve_section_blocks,
 };
 
@@ -39,7 +42,46 @@ pub fn split_block(
     byte_offset: usize,
 ) -> Result<(), MutationError> {
     let (blocks_list, block_map, local) = get_block_map_and_list(loro, block_index)?;
+    split_block_in_list(&blocks_list, &block_map, local, byte_offset, block_index)
+}
+
+/// Path-aware [`split_block`]: splits the block addressed by `path` at
+/// `byte_offset`, inserting the tail as a new sibling immediately after it
+/// *within the same container* (top-level section, table cell, or note body).
+///
+/// The new block inherits type and props exactly as for [`split_block`]; the
+/// difference is only *where* the block list lives — the leaf step's container
+/// rather than the section. The cursor's next block is `path` with the leaf
+/// block index incremented by one.
+///
+/// # Errors
+///
+/// As for [`split_block`], plus [`MutationError::InvalidBlockPath`] when a
+/// descent step of `path` is invalid.
+pub fn split_block_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+) -> Result<(), MutationError> {
+    let (blocks_list, local) = resolve_block_list(loro, path)?;
+    let block_map = blocks_list
+        .get(local)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_map().ok())
+        .ok_or_else(|| MutationError::InvalidBlockPath(format!("no block {local} to split")))?;
+    split_block_in_list(&blocks_list, &block_map, local, byte_offset, path.root)
+}
 
+/// Core split: splits `block_map` (the block at `local` in `blocks_list`) at
+/// `byte_offset`, inserting the tail as a new block at `local + 1` in the same
+/// list. `block_index` is used only for error reporting.
+fn split_block_in_list(
+    blocks_list: &LoroMovableList,
+    block_map: &LoroMap,
+    local: usize,
+    byte_offset: usize,
+    block_index: usize,
+) -> Result<(), MutationError> {
     // Get the LoroText for the source block.
     let text_container = block_map
         .get(KEY_CONTENT)
@@ -138,7 +180,6 @@ pub fn merge_block(loro: &LoroDoc, block_index: usize) -> Result<usize, Mutation
     if block_index == 0 {
         return Err(MutationError::NoPreviousBlock);
     }
-    let prev_index = block_index - 1;
 
     // Resolve the current block to its section's list and its index within that
     // section. A `local` of 0 means the previous block is the last block of an
@@ -147,21 +188,51 @@ pub fn merge_block(loro: &LoroDoc, block_index: usize) -> Result<usize, Mutation
     if local == 0 {
         return Err(MutationError::CrossSectionMerge);
     }
+    merge_block_in_list(&blocks_list, local, block_index)
+}
+
+/// Path-aware [`merge_block`]: merges the block addressed by `path` into its
+/// previous sibling *within the same container* (top-level section, table cell,
+/// or note body), returning the join offset (the prior UTF-8 length of the
+/// previous block). The cursor's merged position is `path` with the leaf block
+/// index decremented by one and that join offset.
+///
+/// # Errors
+///
+/// - [`MutationError::NoPreviousBlock`] — the addressed block is the first of
+///   its container, so there is no sibling to merge into (a container boundary
+///   is never crossed).
+/// - [`MutationError::InvalidBlockPath`] — a descent step of `path` is invalid.
+/// - [`MutationError::TextNotFound`] / [`MutationError::Loro`] — as for
+///   [`merge_block`].
+pub fn merge_block_at(loro: &LoroDoc, path: &BlockPath) -> Result<usize, MutationError> {
+    let (blocks_list, local) = resolve_block_list(loro, path)?;
+    if local == 0 {
+        return Err(MutationError::NoPreviousBlock);
+    }
+    merge_block_in_list(&blocks_list, local, path.root)
+}
 
-    // Validate block_index and read its text before mutating.
-    let curr_text_container = get_loro_text_for_block(loro, block_index)?;
-    let tail = curr_text_container.to_string();
+/// Core merge: appends block `local`'s text into block `local - 1` within
+/// `blocks_list`, then removes block `local`. Returns the join offset (the prior
+/// UTF-8 length of block `local - 1`). Callers must ensure `local >= 1`.
+/// `block_index` is used only for error reporting.
+fn merge_block_in_list(
+    blocks_list: &LoroMovableList,
+    local: usize,
+    block_index: usize,
+) -> Result<usize, MutationError> {
+    // Read the current block's text before mutating.
+    let tail = list_block_text(blocks_list, local, block_index)?.to_string();
 
-    // Validate prev_index (same section, `local - 1`) and get its LoroText.
-    let prev_text = get_loro_text_for_block(loro, prev_index)?;
+    // Append it to the previous block (`local - 1`).
+    let prev_text = list_block_text(blocks_list, local - 1, block_index)?;
     let merged_offset = prev_text.len_utf8();
-
-    // Append block N's text to block N-1.
     if !tail.is_empty() {
         prev_text.insert_utf8(merged_offset, &tail)?;
     }
 
-    // Remove block N from its section's list, by its index within that section.
+    // Remove the now-merged block from its list.
     if local >= blocks_list.len() {
         return Err(MutationError::BlockIndexOutOfRange(block_index));
     }
@@ -169,3 +240,48 @@ pub fn merge_block(loro: &LoroDoc, block_index: usize) -> Result<usize, Mutation
 
     Ok(merged_offset)
 }
+
+/// Navigates to the `LoroText` content of block `local` in `blocks_list`.
+/// `block_index` is used only for the [`MutationError::TextNotFound`] payload.
+fn list_block_text(
+    blocks_list: &LoroMovableList,
+    local: usize,
+    block_index: usize,
+) -> Result<LoroText, MutationError> {
+    blocks_list
+        .get(local)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_map().ok())
+        .and_then(|m| m.get(KEY_CONTENT))
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_text().ok())
+        .ok_or(MutationError::TextNotFound(block_index))
+}
+
+/// Inserts `block` as a new top-level block immediately after the block at
+/// `block_index` (within the same section), returning the new block's
+/// document-global index (`block_index + 1`).
+///
+/// The block is written with the bridge's own schema, so it round-trips through
+/// `loro_to_document` and (for a `Block::Table`) its cells become live editable
+/// containers reachable via a `BlockPath`. Used by the editor's Insert → Table
+/// control. Nesting (inserting a block inside a cell/note) is not addressed
+/// here — the cursor's root block is used.
+///
+/// # Errors
+///
+/// - [`MutationError::BlockIndexOutOfRange`] — `block_index` is out of range.
+/// - [`MutationError::Encode`] — the bridge could not serialize `block`.
+/// - [`MutationError::Loro`] — an underlying Loro error.
+#[cfg(feature = "serde")]
+pub fn insert_block_after(
+    loro: &LoroDoc,
+    block_index: usize,
+    block: &Block,
+) -> Result<usize, MutationError> {
+    let (blocks_list, _block_map, local) = get_block_map_and_list(loro, block_index)?;
+    let new_map = blocks_list.insert_container(local + 1, LoroMap::new())?;
+    crate::loro_bridge::map_block(block, &new_map)
+        .map_err(|e| MutationError::Encode(e.to_string()))?;
+    Ok(block_index + 1)
+}
diff --git a/loki-doc-model/src/loro_mutation/mod.rs b/loki-doc-model/src/loro_mutation/mod.rs
index b7fa028d..2cc30a9e 100644
--- a/loki-doc-model/src/loro_mutation/mod.rs
+++ b/loki-doc-model/src/loro_mutation/mod.rs
@@ -27,14 +27,27 @@
 //! All `byte_offset` and `len` parameters are **UTF-8 byte positions**.
 
 mod block;
+mod nested;
+#[cfg(feature = "serde")]
+mod objects;
 mod style;
 mod text;
 
-pub use self::block::{merge_block, split_block};
+#[cfg(feature = "serde")]
+pub use self::block::insert_block_after;
+pub use self::block::{merge_block, merge_block_at, split_block, split_block_at};
+pub use self::nested::{
+    BlockPath, PathStep, delete_text_at, get_block_text_at, get_mark_at_path, insert_text_at,
+    mark_text_at,
+};
+#[cfg(feature = "serde")]
+pub use self::objects::{insert_inline_image_at, insert_inline_note_at};
 pub use self::style::{
     get_block_alignment, get_block_style_name, set_block_alignment, set_block_style,
     set_block_type_heading, set_block_type_para,
 };
+#[cfg(feature = "serde")]
+pub use self::text::insert_inline_image;
 pub use self::text::{
     delete_text, get_block_text, get_mark_at, insert_text, mark_text, replace_text,
 };
@@ -55,6 +68,10 @@ pub enum MutationError {
     /// An error returned by the underlying Loro library.
     #[error("Loro error: {0}")]
     Loro(String),
+    /// Failed to serialize structured inline content (e.g. an image) to the
+    /// JSON snapshot carried by an inline-object mark.
+    #[error("Encoding error: {0}")]
+    Encode(String),
     /// `byte_offset` is out of range or not on a UTF-8 character boundary.
     #[error("Invalid byte offset {offset} for block split")]
     InvalidByteOffset { offset: usize },
@@ -66,6 +83,11 @@ pub enum MutationError {
     /// would remove the break) is not supported.
     #[error("Cannot merge across a section break")]
     CrossSectionMerge,
+    /// A [`nested::BlockPath`] could not be resolved — e.g. a descent step
+    /// addressed a non-table block, or a cell / nested-block index was out of
+    /// range.
+    #[error("Invalid block path: {0}")]
+    InvalidBlockPath(String),
 }
 
 impl From<loro::LoroError> for MutationError {
diff --git a/loki-doc-model/src/loro_mutation/nested.rs b/loki-doc-model/src/loro_mutation/nested.rs
new file mode 100644
index 00000000..0821f103
--- /dev/null
+++ b/loki-doc-model/src/loro_mutation/nested.rs
@@ -0,0 +1,259 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Addressing for content nested inside container blocks (table cells and
+//! footnote/endnote bodies), and text mutations against it.
+//!
+//! The flat mutation API addresses a block by a document-global index into the
+//! section block lists. That cannot reach a paragraph *inside a table cell* or
+//! *inside a note body*, whose `LoroText` lives under the owning block's
+//! [`KEY_TABLE_CELLS`] / [`KEY_NOTES`] container (see `loro_bridge::table` and
+//! `loro_bridge::inline_objects`). A [`BlockPath`] names such a target: a root
+//! block plus zero or more [`PathStep`] descents — each selecting a cell or note
+//! (in the bridge's flat order) and a block within it. The path is recursive, so
+//! a table nested in a cell, or a note inside a cell, is reachable too.
+//!
+//! Mutating the live nested `LoroText` round-trips: the bridge rebuilds each
+//! cell / note body from these same containers on read.
+
+use loro::{LoroDoc, LoroMap, LoroMovableList, LoroText, LoroValue};
+
+use super::{MutationError, get_block_map_and_list, resolve_section_blocks};
+use crate::loro_schema::{KEY_CONTENT, KEY_NOTES, KEY_TABLE_CELLS};
+
+/// One descent into a container block: select a cell (of a table) or a note body
+/// (of a paragraph), then a block within that nested block list.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PathStep {
+    /// Into a table's `cell`-th cell (bridge flat head → bodies → foot order),
+    /// then the `block`-th block of that cell.
+    Cell {
+        /// Flat cell index within the table's [`KEY_TABLE_CELLS`] list.
+        cell: usize,
+        /// Block index within that cell's content.
+        block: usize,
+    },
+    /// Into a block's `note`-th footnote/endnote body, then the `block`-th block
+    /// of that body.
+    Note {
+        /// Note index within the block's [`KEY_NOTES`] list.
+        note: usize,
+        /// Block index within that note's body.
+        block: usize,
+    },
+}
+
+impl PathStep {
+    /// The container key, nested-list index, block index, and a label for errors.
+    fn parts(self) -> (&'static str, usize, usize, &'static str) {
+        match self {
+            PathStep::Cell { cell, block } => (KEY_TABLE_CELLS, cell, block, "cell"),
+            PathStep::Note { note, block } => (KEY_NOTES, note, block, "note"),
+        }
+    }
+}
+
+/// A path to a block, either top-level or nested inside table cell(s) / note(s).
+///
+/// `root` is a document-global block index (the same space the flat API and the
+/// cursor use); `steps` descends through containers. An empty `steps` resolves
+/// exactly like the flat API.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BlockPath {
+    /// Document-global index of the root block.
+    pub root: usize,
+    /// Successive container descents from the root.
+    pub steps: Vec<PathStep>,
+}
+
+impl BlockPath {
+    /// A top-level block (no nesting) — equivalent to the flat API.
+    #[must_use]
+    pub fn block(root: usize) -> Self {
+        Self {
+            root,
+            steps: Vec::new(),
+        }
+    }
+
+    /// A block at `block` inside the `cell`-th cell of the table at `root`.
+    #[must_use]
+    pub fn in_cell(root: usize, cell: usize, block: usize) -> Self {
+        Self {
+            root,
+            steps: vec![PathStep::Cell { cell, block }],
+        }
+    }
+
+    /// A block at `block` inside the `note`-th footnote/endnote body of `root`.
+    #[must_use]
+    pub fn in_note(root: usize, note: usize, block: usize) -> Self {
+        Self {
+            root,
+            steps: vec![PathStep::Note { note, block }],
+        }
+    }
+}
+
+/// The movable list of blocks for the `container_idx`-th cell / note body under
+/// `key` in `parent_map` (the inner list that `block`-indices address).
+fn nested_block_list(
+    parent_map: &LoroMap,
+    key: &str,
+    container_idx: usize,
+    label: &str,
+) -> Result<LoroMovableList, MutationError> {
+    let container = parent_map
+        .get(key)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok())
+        .ok_or_else(|| MutationError::InvalidBlockPath(format!("block has no {label}s")))?;
+    container
+        .get(container_idx)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_movable_list().ok())
+        .ok_or_else(|| MutationError::InvalidBlockPath(format!("no {label} {container_idx}")))
+}
+
+/// Descends one [`PathStep`] from a container block's map to a nested block's map.
+fn descend(parent_map: &LoroMap, step: PathStep) -> Result<LoroMap, MutationError> {
+    let (key, container_idx, block_idx, label) = step.parts();
+    let inner = nested_block_list(parent_map, key, container_idx, label)?;
+    inner
+        .get(block_idx)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_map().ok())
+        .ok_or_else(|| {
+            MutationError::InvalidBlockPath(format!(
+                "no block {block_idx} in {label} {container_idx}"
+            ))
+        })
+}
+
+/// Resolves `path` to the movable list that *contains* the addressed block and
+/// the block's index within that list.
+///
+/// For an empty path this is the root block's section list — the same space the
+/// flat API uses; otherwise it descends to the leaf step's container (a table
+/// cell's or note body's block list) and pairs it with the leaf block index.
+/// This is the seam the path-aware structural ops ([`super::split_block_at`],
+/// [`super::merge_block_at`]) build on: split inserts and merge deletes within
+/// this list, so a paragraph split/merge stays inside its own container.
+pub(super) fn resolve_block_list(
+    loro: &LoroDoc,
+    path: &BlockPath,
+) -> Result<(LoroMovableList, usize), MutationError> {
+    let Some((last, rest)) = path.steps.split_last() else {
+        let (list, local) = resolve_section_blocks(loro, path.root)?;
+        return Ok((list, local));
+    };
+    let (_, mut block_map, _) = get_block_map_and_list(loro, path.root)?;
+    for step in rest {
+        block_map = descend(&block_map, *step)?;
+    }
+    let (key, container_idx, block_idx, label) = last.parts();
+    let inner = nested_block_list(&block_map, key, container_idx, label)?;
+    Ok((inner, block_idx))
+}
+
+/// Resolves `path` to the block's `LoroMap`.
+pub(super) fn resolve_block_map(
+    loro: &LoroDoc,
+    path: &BlockPath,
+) -> Result<LoroMap, MutationError> {
+    let (_, mut block_map, _) = get_block_map_and_list(loro, path.root)?;
+    for step in &path.steps {
+        block_map = descend(&block_map, *step)?;
+    }
+    Ok(block_map)
+}
+
+/// Resolves `path` to the `LoroText` content container of the addressed block.
+pub(super) fn text_for_path(loro: &LoroDoc, path: &BlockPath) -> Result<LoroText, MutationError> {
+    resolve_block_map(loro, path)?
+        .get(KEY_CONTENT)
+        .and_then(|v| v.into_container().ok())
+        .and_then(|c| c.into_text().ok())
+        .ok_or(MutationError::TextNotFound(path.root))
+}
+
+/// Inserts `text` at UTF-8 `byte_offset` into the block addressed by `path`.
+///
+/// # Errors
+///
+/// [`MutationError::InvalidBlockPath`] when a descent step is invalid,
+/// [`MutationError::TextNotFound`] when the target has no text, or
+/// [`MutationError::Loro`] for an internal Loro error.
+pub fn insert_text_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+    text: &str,
+) -> Result<(), MutationError> {
+    text_for_path(loro, path)?.insert_utf8(byte_offset, text)?;
+    Ok(())
+}
+
+/// Deletes `len` UTF-8 bytes at `byte_offset` from the block addressed by
+/// `path`. A `len` of `0` is a no-op.
+pub fn delete_text_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+    len: usize,
+) -> Result<(), MutationError> {
+    if len == 0 {
+        return Ok(());
+    }
+    text_for_path(loro, path)?.delete_utf8(byte_offset, len)?;
+    Ok(())
+}
+
+/// Applies a mark over a UTF-8 byte range in the block addressed by `path`.
+/// A `byte_start >= byte_end` range is a no-op.
+pub fn mark_text_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_start: usize,
+    byte_end: usize,
+    mark_key: &str,
+    mark_value: LoroValue,
+) -> Result<(), MutationError> {
+    if byte_start >= byte_end {
+        return Ok(());
+    }
+    text_for_path(loro, path)?
+        .mark_utf8(byte_start..byte_end, mark_key, mark_value)
+        .map_err(MutationError::from)
+}
+
+/// Returns the plain text of the block addressed by `path` (empty when the path
+/// does not resolve to a text block).
+#[must_use]
+pub fn get_block_text_at(loro: &LoroDoc, path: &BlockPath) -> String {
+    text_for_path(loro, path)
+        .map(|t| t.to_string())
+        .unwrap_or_default()
+}
+
+/// Returns the value of `mark_key` at UTF-8 `byte_offset` in the block
+/// addressed by `path`, or `None` if unset there.
+pub fn get_mark_at_path(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+    mark_key: &str,
+) -> Result<Option<LoroValue>, MutationError> {
+    let text = text_for_path(loro, path)?;
+    let mut byte_pos = 0usize;
+    for delta in text.to_delta() {
+        if let loro::TextDelta::Insert { insert, attributes } = delta {
+            let span_bytes = insert.len();
+            if byte_offset < byte_pos + span_bytes {
+                return Ok(attributes.and_then(|attrs| attrs.get(mark_key).cloned()));
+            }
+            byte_pos += span_bytes;
+        }
+    }
+    Ok(None)
+}
diff --git a/loki-doc-model/src/loro_mutation/objects.rs b/loki-doc-model/src/loro_mutation/objects.rs
new file mode 100644
index 00000000..5d38bc1c
--- /dev/null
+++ b/loki-doc-model/src/loro_mutation/objects.rs
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Inserts of structured inline objects (images, footnotes/endnotes) into a
+//! block's live text, addressed by a [`BlockPath`] so the target may be a
+//! top-level paragraph, a table cell, or a note body.
+//!
+//! Both objects are anchored by a single `OBJECT_REPLACEMENT_CHAR`: an image
+//! carries its whole `serde`-JSON snapshot in a [`MARK_IMAGE`] mark, while a
+//! note carries a `(kind, idx)` pair in a [`MARK_NOTE`] mark with its body
+//! stored as a live container under the block's `KEY_NOTES` list (the bridge's
+//! `loro_bridge::inline_objects` owns that schema; this module addresses where
+//! the anchor goes and delegates the body write to it).
+
+use loro::{LoroDoc, LoroValue};
+
+use super::nested::{resolve_block_map, text_for_path};
+use super::{BlockPath, MutationError, insert_text_at, mark_text_at};
+use crate::content::block::Block;
+use crate::content::inline::{Inline, NoteKind};
+use crate::loro_schema::{MARK_IMAGE, OBJECT_REPLACEMENT_STR};
+
+/// Inserts an inline image at `byte_offset` in the block addressed by `path`.
+///
+/// The image becomes an `OBJECT_REPLACEMENT_CHAR` anchor + [`MARK_IMAGE`]
+/// snapshot (the bridge's native encoding) inside the addressed paragraph —
+/// which may be a table cell or note body. `image` must be an `Inline::Image`.
+pub fn insert_inline_image_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+    image: &Inline,
+) -> Result<(), MutationError> {
+    if !matches!(image, Inline::Image(..)) {
+        return Err(MutationError::Encode("not an Inline::Image".to_string()));
+    }
+    let json = serde_json::to_string(image).map_err(|e| MutationError::Encode(e.to_string()))?;
+    insert_text_at(loro, path, byte_offset, OBJECT_REPLACEMENT_STR)?;
+    let end = byte_offset + OBJECT_REPLACEMENT_STR.len();
+    mark_text_at(
+        loro,
+        path,
+        byte_offset,
+        end,
+        MARK_IMAGE,
+        LoroValue::from(json),
+    )?;
+    Ok(())
+}
+
+/// Inserts a footnote/endnote at `byte_offset` in the block addressed by `path`,
+/// with `body` as its initial content (typically one empty paragraph the user
+/// then edits).
+///
+/// The anchor is an `OBJECT_REPLACEMENT_CHAR` marked with `(kind, idx)`; the
+/// body is written as a live container under the block's `KEY_NOTES` list, so
+/// it round-trips through the bridge and is reachable for nested editing via a
+/// [`BlockPath`] step `PathStep::Note { note: idx, .. }`.
+///
+/// # Errors
+///
+/// [`MutationError::InvalidBlockPath`] when `path` does not resolve,
+/// [`MutationError::TextNotFound`] when the target block has no text, or
+/// [`MutationError::Encode`] when the bridge cannot write the note.
+pub fn insert_inline_note_at(
+    loro: &LoroDoc,
+    path: &BlockPath,
+    byte_offset: usize,
+    kind: &NoteKind,
+    body: &[Block],
+) -> Result<(), MutationError> {
+    let block_map = resolve_block_map(loro, path)?;
+    // `text_for_path` resolves (and validates) the same block's `LoroText`.
+    let text = text_for_path(loro, path)?;
+    crate::loro_bridge::insert_note_at(&text, &block_map, byte_offset, kind, body)
+        .map_err(|e| MutationError::Encode(e.to_string()))
+}
diff --git a/loki-doc-model/src/loro_mutation/text.rs b/loki-doc-model/src/loro_mutation/text.rs
index ac5c8d4e..f0452d19 100644
--- a/loki-doc-model/src/loro_mutation/text.rs
+++ b/loki-doc-model/src/loro_mutation/text.rs
@@ -8,6 +8,8 @@ use std::collections::HashMap;
 use loro::{LoroDoc, LoroText, LoroValue, TextDelta};
 
 use super::{MutationError, get_loro_text_for_block};
+#[cfg(feature = "serde")]
+use crate::content::inline::Inline;
 use crate::loro_schema::CHAR_MARK_KEYS;
 
 /// Inserts `text` at UTF-8 `byte_offset` into the `LoroText` for the block
@@ -164,6 +166,24 @@ pub fn mark_text(
         .map_err(MutationError::from)
 }
 
+/// Inserts an inline image at UTF-8 `byte_offset` in top-level block
+/// `block_index` — a thin wrapper over [`super::insert_inline_image_at`] with a
+/// flat [`super::BlockPath`]. See that function for the encoding and errors.
+#[cfg(feature = "serde")]
+pub fn insert_inline_image(
+    loro: &LoroDoc,
+    block_index: usize,
+    byte_offset: usize,
+    image: &Inline,
+) -> Result<(), MutationError> {
+    super::insert_inline_image_at(
+        loro,
+        &super::BlockPath::block(block_index),
+        byte_offset,
+        image,
+    )
+}
+
 /// Returns the value of a named mark at a UTF-8 byte offset within a block,
 /// or `None` if the mark is not set at that position.
 ///
diff --git a/loki-doc-model/src/loro_mutation/text_tests.rs b/loki-doc-model/src/loro_mutation/text_tests.rs
index a1b6d617..63acc6c7 100644
--- a/loki-doc-model/src/loro_mutation/text_tests.rs
+++ b/loki-doc-model/src/loro_mutation/text_tests.rs
@@ -135,3 +135,49 @@ fn replace_keeps_a_uniformly_formatted_word_formatted() {
     assert_eq!(spans[0].0, "the");
     assert_eq!(spans[0].1, Some(red()), "replacement keeps the word's red");
 }
+
+#[cfg(feature = "serde")]
+#[test]
+fn insert_inline_image_makes_a_discrete_editable_image() {
+    use crate::content::inline::LinkTarget;
+    use crate::loro_mutation::insert_inline_image;
+
+    let block = Block::Para(vec![Inline::Str("ab".to_string())]);
+    let section = Section::with_layout_and_blocks(Default::default(), vec![block]);
+    let mut doc = Document::new();
+    doc.sections = vec![section];
+    let loro = document_to_loro(&doc).expect("to loro");
+
+    let image = Inline::Image(
+        NodeAttr::default(),
+        vec![Inline::Str("alt".to_string())],
+        LinkTarget::new("data:image/png;base64,AAAA"),
+    );
+    // Insert between 'a' and 'b'.
+    insert_inline_image(&loro, 0, 1, &image).expect("insert image");
+
+    let rebuilt = loro_to_document(&loro).expect("rebuild");
+    let Block::Para(inlines) = &rebuilt.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    // The image is a discrete inline between the two characters.
+    assert_eq!(inlines.len(), 3, "expected Str, Image, Str: {inlines:?}");
+    assert!(matches!(inlines[0], Inline::Str(ref s) if s == "a"));
+    assert_eq!(inlines[1], image, "image round-trips exactly");
+    assert!(matches!(inlines[2], Inline::Str(ref s) if s == "b"));
+}
+
+#[cfg(feature = "serde")]
+#[test]
+fn insert_inline_image_rejects_non_image() {
+    use crate::loro_mutation::{MutationError, insert_inline_image};
+
+    let block = Block::Para(vec![Inline::Str("ab".to_string())]);
+    let section = Section::with_layout_and_blocks(Default::default(), vec![block]);
+    let mut doc = Document::new();
+    doc.sections = vec![section];
+    let loro = document_to_loro(&doc).expect("to loro");
+
+    let err = insert_inline_image(&loro, 0, 1, &Inline::Str("x".to_string()));
+    assert!(matches!(err, Err(MutationError::Encode(_))));
+}
diff --git a/loki-doc-model/src/loro_schema.rs b/loki-doc-model/src/loro_schema.rs
index 3c06d4de..8820becd 100644
--- a/loki-doc-model/src/loro_schema.rs
+++ b/loki-doc-model/src/loro_schema.rs
@@ -90,6 +90,22 @@ pub const BLOCK_TYPE_OPAQUE: &str = "opaque";
 /// Key for the serialized JSON snapshot of a [`BLOCK_TYPE_OPAQUE`] block.
 pub const KEY_OPAQUE_JSON: &str = "opaque_json";
 
+/// Key (within a [`BLOCK_TYPE_TABLE`] block map) for the table's structural
+/// skeleton — a `serde`-JSON snapshot of the whole `Table` **with every cell's
+/// blocks emptied**. Carries the grid (col specs, widths), section/row layout,
+/// spans, cell/row props, borders, caption, and attributes. Cell *content*
+/// lives separately under [`KEY_TABLE_CELLS`] as live CRDT containers, so cell
+/// text round-trips natively (and concurrent edits to different cells merge)
+/// instead of as one opaque blob.
+pub const KEY_TABLE_SKELETON: &str = "table_skeleton";
+
+/// Key (within a [`BLOCK_TYPE_TABLE`] block map) for the live cell contents — a
+/// movable list with one entry per cell (in head → bodies → foot, row-major
+/// order), each entry itself a movable list of the cell's blocks (written via
+/// the shared block path). Re-attached to the [`KEY_TABLE_SKELETON`] cells on
+/// read by the same traversal order.
+pub const KEY_TABLE_CELLS: &str = "table_cells";
+
 // -----------------------------------------------------------------------------
 // CharProps Mark Keys
 // -----------------------------------------------------------------------------
@@ -119,6 +135,47 @@ pub const MARK_KERNING: &str = "kerning";
 pub const MARK_CHAR_STYLE_ID: &str = "char_style_id";
 pub const MARK_OUTLINE: &str = "outline";
 
+// -----------------------------------------------------------------------------
+// Inline objects (anchored by a placeholder char + a data-bearing mark)
+// -----------------------------------------------------------------------------
+
+/// Object-replacement character (U+FFFC) — the in-text anchor for an inline
+/// object whose structured data is carried by a mark over the single anchor
+/// position. The anchor occupies one Unicode scalar so the object is a
+/// discrete, positioned, deletable element in the flat text stream.
+pub const OBJECT_REPLACEMENT_CHAR: char = '\u{FFFC}';
+
+/// String form of [`OBJECT_REPLACEMENT_CHAR`] for `LoroText::insert`.
+pub const OBJECT_REPLACEMENT_STR: &str = "\u{FFFC}";
+
+/// Inline image data: a `serde`-JSON snapshot of the `Inline::Image`, carried
+/// as a mark over a single [`OBJECT_REPLACEMENT_CHAR`] anchor so that
+/// image-bearing paragraphs round-trip *natively* (the image is a live,
+/// positioned inline object) instead of as opaque block snapshots.
+pub const MARK_IMAGE: &str = "image";
+
+/// Inline footnote/endnote reference: carried as a mark over a single
+/// [`OBJECT_REPLACEMENT_CHAR`] anchor. The value is a `serde`-JSON
+/// `(NoteKind, usize)` pair — the note's kind and the index of its **body** in
+/// the block's [`KEY_NOTES`] container. The `usize` index also makes each note's
+/// mark unique, so adjacent notes do not merge into one rich-text delta span.
+///
+/// The body itself is a **live CRDT container** (not a JSON blob in the mark),
+/// so footnote text is editable and mergeable like a table cell's.
+pub const MARK_NOTE: &str = "note";
+
+/// Key (within a paragraph-like block's map) for the block's note bodies — a
+/// movable list with one entry per [`MARK_NOTE`] anchor in the block, each a
+/// movable list of the note body's blocks (written via the shared block path).
+/// Indexed by the `usize` carried in each anchor's [`MARK_NOTE`] mark.
+pub const KEY_NOTES: &str = "notes";
+
+/// Every inline-object anchor mark key (carried over a single
+/// [`OBJECT_REPLACEMENT_CHAR`]). Registered with non-expanding behaviour and
+/// shared by the write/read paths. Keep in sync as new inline objects migrate
+/// off the opaque-snapshot fallback.
+pub const INLINE_OBJECT_MARK_KEYS: &[&str] = &[MARK_IMAGE, MARK_NOTE];
+
 /// Every character-level mark key (formatting that lives on a text range).
 ///
 /// Single source of truth shared by `document_to_loro` (which registers each
diff --git a/loki-doc-model/src/style/catalog.rs b/loki-doc-model/src/style/catalog.rs
index c0da4a2c..3f4057a4 100644
--- a/loki-doc-model/src/style/catalog.rs
+++ b/loki-doc-model/src/style/catalog.rs
@@ -167,6 +167,33 @@ impl StyleCatalog {
         }
         Some(resolved)
     }
+
+    /// Deletes paragraph style `id`, re-parenting its direct children to `id`'s
+    /// own parent (their grandparent) so the inheritance tree stays connected and
+    /// no child is orphaned (Spec 05 §8). Catalog order is otherwise preserved.
+    ///
+    /// If `id` was the document default paragraph style, the default falls back to
+    /// that grandparent (`None` when `id` was a root). Returns the ids of the
+    /// re-parented children (for the caller's confirmation message). A no-op
+    /// returning an empty vector when `id` is not in the catalog.
+    pub fn delete_paragraph_style(&mut self, id: &StyleId) -> Vec<StyleId> {
+        let Some(style) = self.paragraph_styles.get(id) else {
+            return Vec::new();
+        };
+        let grandparent = style.parent.clone();
+        let children = self.para_children(id);
+        for child in &children {
+            if let Some(c) = self.paragraph_styles.get_mut(child) {
+                c.parent = grandparent.clone();
+            }
+        }
+        // `shift_remove` preserves the order of the remaining styles.
+        self.paragraph_styles.shift_remove(id);
+        if self.default_paragraph_style.as_ref() == Some(id) {
+            self.default_paragraph_style = grandparent;
+        }
+        children
+    }
 }
 
 #[cfg(test)]
diff --git a/loki-doc-model/src/style/catalog_tests.rs b/loki-doc-model/src/style/catalog_tests.rs
index f2fb14e8..62cb02df 100644
--- a/loki-doc-model/src/style/catalog_tests.rs
+++ b/loki-doc-model/src/style/catalog_tests.rs
@@ -203,3 +203,86 @@ fn effective_paragraph_style_falls_back_to_default() {
         Some(&explicit)
     );
 }
+
+// ── delete_paragraph_style (Spec 05 M5) ─────────────────────────────────────
+
+fn plain(id: &str, parent: Option<&str>) -> ParagraphStyle {
+    ParagraphStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        linked_char_style: None,
+        next_style_id: None,
+        para_props: ParaProps::default(),
+        char_props: CharProps::default(),
+        is_default: false,
+        is_custom: true,
+        extensions: ExtensionBag::default(),
+    }
+}
+
+/// A → { B → { D }, C }
+fn small_tree() -> StyleCatalog {
+    let mut c = StyleCatalog::new();
+    for s in [
+        plain("A", None),
+        plain("B", Some("A")),
+        plain("C", Some("A")),
+        plain("D", Some("B")),
+    ] {
+        c.paragraph_styles.insert(s.id.clone(), s);
+    }
+    c
+}
+
+fn parent_of<'a>(c: &'a StyleCatalog, id: &str) -> Option<&'a StyleId> {
+    c.paragraph_styles
+        .get(&StyleId::new(id))
+        .unwrap()
+        .parent
+        .as_ref()
+}
+
+#[test]
+fn deleting_a_middle_style_reparents_children_to_the_grandparent() {
+    let mut c = small_tree();
+    let reparented = c.delete_paragraph_style(&StyleId::new("B"));
+    assert_eq!(reparented, vec![StyleId::new("D")]);
+    assert!(!c.paragraph_styles.contains_key(&StyleId::new("B")));
+    // D's parent is now A (B's former parent), keeping the tree connected.
+    assert_eq!(parent_of(&c, "D"), Some(&StyleId::new("A")));
+}
+
+#[test]
+fn deleting_a_root_makes_its_children_roots() {
+    let mut c = small_tree();
+    let reparented = c.delete_paragraph_style(&StyleId::new("A"));
+    assert_eq!(reparented, vec![StyleId::new("B"), StyleId::new("C")]);
+    assert_eq!(parent_of(&c, "B"), None);
+    assert_eq!(parent_of(&c, "C"), None);
+}
+
+#[test]
+fn deleting_a_leaf_removes_it_without_reparenting() {
+    let mut c = small_tree();
+    assert!(c.delete_paragraph_style(&StyleId::new("D")).is_empty());
+    assert!(!c.paragraph_styles.contains_key(&StyleId::new("D")));
+    // Siblings/parents untouched.
+    assert_eq!(parent_of(&c, "B"), Some(&StyleId::new("A")));
+}
+
+#[test]
+fn deleting_an_absent_style_is_a_noop() {
+    let mut c = small_tree();
+    assert!(c.delete_paragraph_style(&StyleId::new("Ghost")).is_empty());
+    assert_eq!(c.paragraph_styles.len(), 4);
+}
+
+#[test]
+fn deleting_the_document_default_falls_back_to_the_grandparent() {
+    let mut c = small_tree();
+    c.default_paragraph_style = Some(StyleId::new("B"));
+    c.delete_paragraph_style(&StyleId::new("B"));
+    // B's parent was A, so the default falls back to A.
+    assert_eq!(c.default_paragraph_style, Some(StyleId::new("A")));
+}
diff --git a/loki-doc-model/src/style/mod.rs b/loki-doc-model/src/style/mod.rs
index 44f4631d..6b1337d6 100644
--- a/loki-doc-model/src/style/mod.rs
+++ b/loki-doc-model/src/style/mod.rs
@@ -13,7 +13,9 @@ pub mod char_style;
 pub mod list_style;
 pub mod para_style;
 pub mod props;
+pub mod resolve;
 pub mod table_style;
+pub mod tree;
 
 pub use catalog::{ResolvedCharProps, ResolvedParaProps, StyleCatalog, StyleId};
 pub use char_style::CharacterStyle;
@@ -21,4 +23,5 @@ pub use list_style::{
     BulletChar, LabelAlignment, ListId, ListLevel, ListLevelKind, ListStyle, NumberingScheme,
 };
 pub use para_style::ParagraphStyle;
+pub use resolve::{Provenance, Resolved};
 pub use table_style::TableStyle;
diff --git a/loki-doc-model/src/style/para_style.rs b/loki-doc-model/src/style/para_style.rs
index 0c771b91..2fb0acaa 100644
--- a/loki-doc-model/src/style/para_style.rs
+++ b/loki-doc-model/src/style/para_style.rs
@@ -50,8 +50,8 @@ pub struct ParagraphStyle {
     /// at the end of a paragraph with this style. `None` means the same style
     /// continues. ODF: `style:next-style-name`; OOXML: `w:next @w:val`.
     ///
-    // TODO(editing): next_style_id used by split_block to determine
-    // the style of the newly created paragraph after Enter.
+    /// Consumed on the Enter/split path: `loki_text`'s `editor_keydown_ctrl`
+    /// resolves this and applies it to the new block via `set_block_style`.
     pub next_style_id: Option<String>,
 
     /// Whether this is the document's default paragraph style.
@@ -66,6 +66,22 @@ pub struct ParagraphStyle {
     pub extensions: ExtensionBag,
 }
 
+impl ParagraphStyle {
+    /// Whether this is a **built-in** (application-provided) style rather than a
+    /// user-created one — the styles the management panel protects from deletion
+    /// and rename (Spec 05 §8 / audit SM-11).
+    ///
+    /// The rule is the existing model flags: a style is built-in when it is the
+    /// document default (`is_default`) or is not user-custom (`!is_custom`). Spec
+    /// 05 assumed `COMPAT(i18n)` annotations on internal match keys would mark
+    /// built-ins; those do not exist and are not needed — `is_custom` already
+    /// carries the built-in-vs-user distinction, so that framing is dropped.
+    #[must_use]
+    pub fn is_builtin(&self) -> bool {
+        self.is_default || !self.is_custom
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -92,4 +108,29 @@ mod tests {
         assert_eq!(style.parent, Some(parent_id));
         assert_eq!(style.char_props.bold, Some(true));
     }
+
+    fn style(is_default: bool, is_custom: bool) -> ParagraphStyle {
+        ParagraphStyle {
+            id: StyleId("S".into()),
+            display_name: None,
+            parent: None,
+            linked_char_style: None,
+            next_style_id: None,
+            para_props: ParaProps::default(),
+            char_props: CharProps::default(),
+            is_default,
+            is_custom,
+            extensions: ExtensionBag::default(),
+        }
+    }
+
+    #[test]
+    fn is_builtin_distinguishes_application_styles_from_user_styles() {
+        // Built-in: not user-custom.
+        assert!(style(false, false).is_builtin());
+        // The document default is always built-in (protected), even if flagged custom.
+        assert!(style(true, true).is_builtin());
+        // A user-created custom style is not built-in.
+        assert!(!style(false, true).is_builtin());
+    }
 }
diff --git a/loki-doc-model/src/style/resolve.rs b/loki-doc-model/src/style/resolve.rs
new file mode 100644
index 00000000..1114aae2
--- /dev/null
+++ b/loki-doc-model/src/style/resolve.rs
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Provenance-aware style resolution (Spec 05 M1).
+//!
+//! The collapsing resolvers in [`catalog`](crate::style::catalog)
+//! (`resolve_para` / `resolve_char`) answer "what is the effective value?" for
+//! the renderer. The style-management panel (Spec 05 §6) needs more: for each
+//! property, *where the value comes from* — set locally, inherited from a named
+//! ancestor, the document default, or an engine fallback. This module adds that
+//! provenance over the same single-parent tree, plus the cycle guard
+//! re-parenting (§7) needs.
+//!
+//! Resolution is generic over a *getter* that reads one property's local value
+//! from a style, so a single method serves every property of a family without a
+//! giant per-property result struct: the inspector iterates its property list
+//! and resolves each row on demand.
+
+use std::collections::HashSet;
+
+use crate::style::catalog::{MAX_STYLE_CHAIN_DEPTH, StyleCatalog, StyleId};
+use crate::style::char_style::CharacterStyle;
+use crate::style::para_style::ParagraphStyle;
+
+/// Where a resolved property value comes from, relative to the queried style.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Provenance {
+    /// Set directly on the queried style.
+    Local,
+    /// Set by the named ancestor in the style's own `parent` chain.
+    Inherited(StyleId),
+    /// Not set anywhere in the style's chain; supplied by the document default
+    /// style (the OOXML `docDefaults` / ODF default-style fall-through).
+    Default,
+    /// Unset everywhere — the engine/format fallback decides the value.
+    FormatDefault,
+}
+
+/// A resolved property: where it came from and its value.
+///
+/// `value` is `None` only for [`Provenance::FormatDefault`], where the model
+/// holds no value and the rendering engine supplies the fallback.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Resolved<T> {
+    /// Where the value originates.
+    pub provenance: Provenance,
+    /// The resolved value (`None` ⇔ `FormatDefault`).
+    pub value: Option<T>,
+}
+
+impl<T> Resolved<T> {
+    fn local(value: T) -> Self {
+        Self {
+            provenance: Provenance::Local,
+            value: Some(value),
+        }
+    }
+
+    fn inherited(from: StyleId, value: T) -> Self {
+        Self {
+            provenance: Provenance::Inherited(from),
+            value: Some(value),
+        }
+    }
+
+    fn from_default(value: T) -> Self {
+        Self {
+            provenance: Provenance::Default,
+            value: Some(value),
+        }
+    }
+
+    fn format_default() -> Self {
+        Self {
+            provenance: Provenance::FormatDefault,
+            value: None,
+        }
+    }
+
+    /// `true` when the value is set on the queried style itself (an override the
+    /// inspector lets the user reset to inherited).
+    #[must_use]
+    pub fn is_local(&self) -> bool {
+        matches!(self.provenance, Provenance::Local)
+    }
+}
+
+impl StyleCatalog {
+    /// Resolves one property over a **paragraph style's** inheritance chain, with
+    /// provenance. `get` reads the property's *local* value from a style
+    /// (e.g. `|s| s.para_props.alignment.clone()` or `|s| s.char_props.bold`),
+    /// so this one method serves both paragraph properties and the run-default
+    /// character properties of a paragraph style.
+    ///
+    /// Order: the style itself (`Local`), then its `parent` chain (`Inherited`),
+    /// then the document default paragraph style if it is not already in that
+    /// chain (`Default`), else `FormatDefault`. Cycle- and depth-guarded.
+    ///
+    /// Returns `None` only when `id` is not a paragraph style in the catalog.
+    pub fn resolve_para_chain<T: Clone>(
+        &self,
+        id: &StyleId,
+        get: impl Fn(&ParagraphStyle) -> Option<T>,
+    ) -> Option<Resolved<T>> {
+        let style = self.paragraph_styles.get(id)?;
+        if let Some(v) = get(style) {
+            return Some(Resolved::local(v));
+        }
+
+        // Walk the explicit `parent` chain → Inherited.
+        let mut visited = HashSet::new();
+        visited.insert(id.clone());
+        let mut cursor = style.parent.as_ref();
+        for _ in 0..MAX_STYLE_CHAIN_DEPTH {
+            let Some(pid) = cursor else { break };
+            if !visited.insert(pid.clone()) {
+                break; // cycle
+            }
+            let Some(parent) = self.paragraph_styles.get(pid) else {
+                break;
+            };
+            if let Some(v) = get(parent) {
+                return Some(Resolved::inherited(pid.clone(), v));
+            }
+            cursor = parent.parent.as_ref();
+        }
+
+        // Fall through to the document default style (when not already visited).
+        if let Some(def) = self.default_paragraph_style.as_ref()
+            && !visited.contains(def)
+            && let Some(v) = self.first_in_para_chain(def, &get)
+        {
+            return Some(Resolved::from_default(v));
+        }
+
+        Some(Resolved::format_default())
+    }
+
+    /// First local value of a property along a paragraph chain starting at
+    /// `start` (inclusive), cycle/depth-guarded. Backs the `Default`-level lookup.
+    fn first_in_para_chain<T: Clone>(
+        &self,
+        start: &StyleId,
+        get: &impl Fn(&ParagraphStyle) -> Option<T>,
+    ) -> Option<T> {
+        let mut visited = HashSet::new();
+        let mut cursor = Some(start.clone());
+        for _ in 0..MAX_STYLE_CHAIN_DEPTH {
+            let id = cursor?;
+            if !visited.insert(id.clone()) {
+                return None;
+            }
+            let style = self.paragraph_styles.get(&id)?;
+            if let Some(v) = get(style) {
+                return Some(v);
+            }
+            cursor = style.parent.clone();
+        }
+        None
+    }
+
+    /// Resolves one property over a **character style's** inheritance chain, with
+    /// provenance — the standalone-`CharacterStyle` resolver the collapsing
+    /// `resolve_char` never provided (that one walks paragraph styles). The
+    /// character family has no document default, so the levels are `Local`,
+    /// `Inherited`, then `FormatDefault`. Cycle- and depth-guarded.
+    ///
+    /// Returns `None` only when `id` is not a character style in the catalog.
+    pub fn resolve_char_chain<T: Clone>(
+        &self,
+        id: &StyleId,
+        get: impl Fn(&CharacterStyle) -> Option<T>,
+    ) -> Option<Resolved<T>> {
+        let style = self.character_styles.get(id)?;
+        if let Some(v) = get(style) {
+            return Some(Resolved::local(v));
+        }
+        let mut visited = HashSet::new();
+        visited.insert(id.clone());
+        let mut cursor = style.parent.as_ref();
+        for _ in 0..MAX_STYLE_CHAIN_DEPTH {
+            let Some(pid) = cursor else { break };
+            if !visited.insert(pid.clone()) {
+                break; // cycle
+            }
+            let Some(parent) = self.character_styles.get(pid) else {
+                break;
+            };
+            if let Some(v) = get(parent) {
+                return Some(Resolved::inherited(pid.clone(), v));
+            }
+            cursor = parent.parent.as_ref();
+        }
+        Some(Resolved::format_default())
+    }
+
+    /// The paragraph style's ancestors, nearest-first and **including** `id`
+    /// itself, stopping at the root or the first repeat (cycle/depth-guarded).
+    #[must_use]
+    pub fn para_ancestors(&self, id: &StyleId) -> Vec<StyleId> {
+        let mut chain = Vec::new();
+        let mut seen = HashSet::new();
+        let mut cursor = Some(id.clone());
+        for _ in 0..=MAX_STYLE_CHAIN_DEPTH {
+            let Some(current) = cursor else { break };
+            if !seen.insert(current.clone()) {
+                break; // cycle
+            }
+            chain.push(current.clone());
+            cursor = self
+                .paragraph_styles
+                .get(&current)
+                .and_then(|s| s.parent.clone());
+        }
+        chain
+    }
+
+    /// Whether making `new_parent` the parent of `child` would create a cycle in
+    /// the paragraph-style tree — i.e. `new_parent` is `child` itself or a
+    /// descendant of `child`. Re-parenting (Spec 05 §7) must reject these to keep
+    /// the hierarchy a tree.
+    #[must_use]
+    pub fn para_reparent_cycles(&self, child: &StyleId, new_parent: &StyleId) -> bool {
+        // A cycle forms iff `child` lies on `new_parent`'s ancestor chain
+        // (which includes `new_parent` itself, covering `new_parent == child`).
+        self.para_ancestors(new_parent).iter().any(|a| a == child)
+    }
+}
+
+#[cfg(test)]
+#[path = "resolve_tests.rs"]
+mod tests;
diff --git a/loki-doc-model/src/style/resolve_tests.rs b/loki-doc-model/src/style/resolve_tests.rs
new file mode 100644
index 00000000..edf56518
--- /dev/null
+++ b/loki-doc-model/src/style/resolve_tests.rs
@@ -0,0 +1,386 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Provenance-aware resolution (Spec 05 M1): Local / Inherited-from / Default /
+//! FormatDefault over the single-parent tree, cycle safety, and the re-parent
+//! cycle guard.
+
+use super::*;
+use crate::style::char_style::CharacterStyle;
+use crate::style::para_style::ParagraphStyle;
+use crate::style::props::char_props::CharProps;
+use crate::style::props::para_props::{ParaProps, ParagraphAlignment};
+
+// ── Builders ────────────────────────────────────────────────────────────────
+
+fn para(id: &str, parent: Option<&str>, props: ParaProps, char_props: CharProps) -> ParagraphStyle {
+    ParagraphStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        linked_char_style: None,
+        next_style_id: None,
+        para_props: props,
+        char_props,
+        is_default: false,
+        is_custom: false,
+        extensions: Default::default(),
+    }
+}
+
+fn char_style(id: &str, parent: Option<&str>, char_props: CharProps) -> CharacterStyle {
+    CharacterStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        char_props,
+        extensions: Default::default(),
+    }
+}
+
+fn aligned(a: ParagraphAlignment) -> ParaProps {
+    ParaProps {
+        alignment: Some(a),
+        ..Default::default()
+    }
+}
+
+fn bold() -> CharProps {
+    CharProps {
+        bold: Some(true),
+        ..Default::default()
+    }
+}
+
+fn insert_para(cat: &mut StyleCatalog, s: ParagraphStyle) {
+    cat.paragraph_styles.insert(s.id.clone(), s);
+}
+
+fn align_of(s: &ParagraphStyle) -> Option<ParagraphAlignment> {
+    s.para_props.alignment
+}
+
+// ── Paragraph provenance ─────────────────────────────────────────────────────
+
+#[test]
+fn local_property_resolves_as_local() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para(
+            "Body",
+            None,
+            aligned(ParagraphAlignment::Center),
+            CharProps::default(),
+        ),
+    );
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Body"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Local);
+    assert_eq!(r.value, Some(ParagraphAlignment::Center));
+    assert!(r.is_local());
+}
+
+#[test]
+fn inherited_property_names_its_source_ancestor() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para(
+            "Base",
+            None,
+            aligned(ParagraphAlignment::Justify),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para(
+            "Mid",
+            Some("Base"),
+            ParaProps::default(),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para(
+            "Leaf",
+            Some("Mid"),
+            ParaProps::default(),
+            CharProps::default(),
+        ),
+    );
+
+    // Leaf and Mid set no alignment; it is inherited from Base two levels up.
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Leaf"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Inherited(StyleId::new("Base")));
+    assert_eq!(r.value, Some(ParagraphAlignment::Justify));
+    assert!(!r.is_local());
+}
+
+#[test]
+fn nearest_ancestor_wins_over_farther_one() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para(
+            "Base",
+            None,
+            aligned(ParagraphAlignment::Left),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para(
+            "Mid",
+            Some("Base"),
+            aligned(ParagraphAlignment::Right),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para(
+            "Leaf",
+            Some("Mid"),
+            ParaProps::default(),
+            CharProps::default(),
+        ),
+    );
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Leaf"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Inherited(StyleId::new("Mid")));
+    assert_eq!(r.value, Some(ParagraphAlignment::Right));
+}
+
+#[test]
+fn document_default_supplies_unset_property_as_default() {
+    let mut cat = StyleCatalog::new();
+    // "Normal" is the document default and sets alignment; "Loose" does not
+    // chain to it, so the property falls through as Default (docDefaults).
+    insert_para(
+        &mut cat,
+        para(
+            "Normal",
+            None,
+            aligned(ParagraphAlignment::Left),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para("Loose", None, ParaProps::default(), CharProps::default()),
+    );
+    cat.default_paragraph_style = Some(StyleId::new("Normal"));
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Loose"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Default);
+    assert_eq!(r.value, Some(ParagraphAlignment::Left));
+}
+
+#[test]
+fn explicit_chain_to_default_reports_inherited_not_default() {
+    let mut cat = StyleCatalog::new();
+    // When a style explicitly bases on the default, a property set there is
+    // *Inherited from that named ancestor*, not the anonymous Default level.
+    insert_para(
+        &mut cat,
+        para(
+            "Normal",
+            None,
+            aligned(ParagraphAlignment::Left),
+            CharProps::default(),
+        ),
+    );
+    insert_para(
+        &mut cat,
+        para(
+            "Quote",
+            Some("Normal"),
+            ParaProps::default(),
+            CharProps::default(),
+        ),
+    );
+    cat.default_paragraph_style = Some(StyleId::new("Normal"));
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Quote"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Inherited(StyleId::new("Normal")));
+}
+
+#[test]
+fn unset_everywhere_is_format_default_with_no_value() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para("Bare", None, ParaProps::default(), CharProps::default()),
+    );
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Bare"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::FormatDefault);
+    assert_eq!(r.value, None);
+}
+
+#[test]
+fn run_default_char_prop_of_a_paragraph_style_resolves_via_same_method() {
+    let mut cat = StyleCatalog::new();
+    insert_para(&mut cat, para("Base", None, ParaProps::default(), bold()));
+    insert_para(
+        &mut cat,
+        para(
+            "Leaf",
+            Some("Base"),
+            ParaProps::default(),
+            CharProps::default(),
+        ),
+    );
+
+    // The same generic method resolves a paragraph style's run-default char prop.
+    let r = cat
+        .resolve_para_chain(&StyleId::new("Leaf"), |s| s.char_props.bold)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::Inherited(StyleId::new("Base")));
+    assert_eq!(r.value, Some(true));
+}
+
+#[test]
+fn unknown_style_id_resolves_to_none() {
+    let cat = StyleCatalog::new();
+    assert!(
+        cat.resolve_para_chain(&StyleId::new("Ghost"), align_of)
+            .is_none()
+    );
+}
+
+#[test]
+fn cyclic_parent_chain_terminates() {
+    let mut cat = StyleCatalog::new();
+    // A → B → A. No alignment set anywhere; resolution must terminate, not loop.
+    insert_para(
+        &mut cat,
+        para("A", Some("B"), ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("B", Some("A"), ParaProps::default(), CharProps::default()),
+    );
+
+    let r = cat
+        .resolve_para_chain(&StyleId::new("A"), align_of)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::FormatDefault);
+}
+
+// ── Character-style provenance (fixes the misnamed `resolve_char`) ────────────
+
+#[test]
+fn character_style_inherits_along_its_own_chain() {
+    let mut cat = StyleCatalog::new();
+    cat.character_styles.insert(
+        StyleId::new("Emphasis"),
+        char_style("Emphasis", None, bold()),
+    );
+    cat.character_styles.insert(
+        StyleId::new("StrongEmphasis"),
+        char_style("StrongEmphasis", Some("Emphasis"), CharProps::default()),
+    );
+
+    let r = cat
+        .resolve_char_chain(&StyleId::new("StrongEmphasis"), |s| s.char_props.bold)
+        .unwrap();
+    assert_eq!(
+        r.provenance,
+        Provenance::Inherited(StyleId::new("Emphasis"))
+    );
+    assert_eq!(r.value, Some(true));
+}
+
+#[test]
+fn character_style_unset_is_format_default() {
+    let mut cat = StyleCatalog::new();
+    cat.character_styles.insert(
+        StyleId::new("Plain"),
+        char_style("Plain", None, CharProps::default()),
+    );
+
+    let r = cat
+        .resolve_char_chain(&StyleId::new("Plain"), |s| s.char_props.italic)
+        .unwrap();
+    assert_eq!(r.provenance, Provenance::FormatDefault);
+    assert_eq!(r.value, None);
+}
+
+// ── Re-parent cycle guard ────────────────────────────────────────────────────
+
+#[test]
+fn reparent_cycle_guard_rejects_self_and_descendants() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para("A", None, ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("B", Some("A"), ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("C", Some("B"), ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("Other", None, ParaProps::default(), CharProps::default()),
+    );
+
+    let a = StyleId::new("A");
+    let b = StyleId::new("B");
+    let c = StyleId::new("C");
+    let other = StyleId::new("Other");
+
+    // Self-parent is a cycle.
+    assert!(cat.para_reparent_cycles(&a, &a));
+    // Re-parenting A under its descendant C is a cycle.
+    assert!(cat.para_reparent_cycles(&a, &c));
+    // Re-parenting A under its direct child B is a cycle.
+    assert!(cat.para_reparent_cycles(&a, &b));
+    // Re-parenting C under an unrelated style is fine.
+    assert!(!cat.para_reparent_cycles(&c, &other));
+    // Re-parenting C under A (its grandparent — already an ancestor) is fine:
+    // it stays a tree.
+    assert!(!cat.para_reparent_cycles(&c, &a));
+}
+
+#[test]
+fn para_ancestors_lists_chain_nearest_first_including_self() {
+    let mut cat = StyleCatalog::new();
+    insert_para(
+        &mut cat,
+        para("A", None, ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("B", Some("A"), ParaProps::default(), CharProps::default()),
+    );
+    insert_para(
+        &mut cat,
+        para("C", Some("B"), ParaProps::default(), CharProps::default()),
+    );
+
+    assert_eq!(
+        cat.para_ancestors(&StyleId::new("C")),
+        vec![StyleId::new("C"), StyleId::new("B"), StyleId::new("A")]
+    );
+}
diff --git a/loki-doc-model/src/style/tree.rs b/loki-doc-model/src/style/tree.rs
new file mode 100644
index 00000000..a2cbf327
--- /dev/null
+++ b/loki-doc-model/src/style/tree.rs
@@ -0,0 +1,151 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Paragraph-style hierarchy queries for the inheritance tree view and its
+//! impact preview (Spec 05 M4).
+//!
+//! The single-parent tree of [`resolve`](crate::style::resolve) has an
+//! *upward* view (`para_ancestors`, `para_reparent_cycles`); this module adds the
+//! *downward* view — direct children, transitive descendants, and the
+//! **exact dependent set affected** by changing one property on a base style.
+//! All walks are cycle/depth-guarded so a corrupt catalog can never loop.
+
+use std::collections::HashSet;
+
+use crate::style::catalog::{MAX_STYLE_CHAIN_DEPTH, StyleCatalog, StyleId};
+use crate::style::para_style::ParagraphStyle;
+
+impl StyleCatalog {
+    /// The direct children of paragraph style `id` (styles whose `parent` is
+    /// `id`), in catalog order.
+    #[must_use]
+    pub fn para_children(&self, id: &StyleId) -> Vec<StyleId> {
+        self.paragraph_styles
+            .iter()
+            .filter(|(_, s)| s.parent.as_ref() == Some(id))
+            .map(|(cid, _)| cid.clone())
+            .collect()
+    }
+
+    /// All transitive descendants of paragraph style `id` (breadth-first, nearest
+    /// generation first), excluding `id` itself. Cycle- and depth-guarded.
+    #[must_use]
+    pub fn para_descendants(&self, id: &StyleId) -> Vec<StyleId> {
+        let mut out = Vec::new();
+        let mut seen = HashSet::new();
+        seen.insert(id.clone());
+        let mut frontier = self.para_children(id);
+        // Bound the number of generations walked; a catalog cannot have a longer
+        // legitimate chain than `MAX_STYLE_CHAIN_DEPTH`.
+        for _ in 0..=MAX_STYLE_CHAIN_DEPTH {
+            if frontier.is_empty() {
+                break;
+            }
+            let mut next = Vec::new();
+            for child in frontier {
+                if seen.insert(child.clone()) {
+                    next.extend(self.para_children(&child));
+                    out.push(child);
+                }
+            }
+            frontier = next;
+        }
+        out
+    }
+
+    /// The paragraph-style forest in pre-order (each parent immediately before
+    /// its subtree), paired with each style's depth — the render order for an
+    /// indented tree view (Spec 05 §7).
+    ///
+    /// Roots are styles with no parent (or a parent absent from the catalog), in
+    /// catalog order; children follow in catalog order. Cycle-safe: any styles
+    /// only reachable through a cycle are appended once at depth 0.
+    #[must_use]
+    pub fn para_forest_preorder(&self) -> Vec<(StyleId, usize)> {
+        let mut out = Vec::new();
+        let mut visited = HashSet::new();
+        let is_root = |s: &ParagraphStyle| {
+            s.parent
+                .as_ref()
+                .is_none_or(|p| !self.paragraph_styles.contains_key(p))
+        };
+        for (id, style) in &self.paragraph_styles {
+            if is_root(style) {
+                self.preorder_visit(id, 0, &mut visited, &mut out);
+            }
+        }
+        // Styles stranded in a cycle (no root) — surface them, once, at depth 0.
+        let stranded: Vec<StyleId> = self
+            .paragraph_styles
+            .keys()
+            .filter(|id| !visited.contains(*id))
+            .cloned()
+            .collect();
+        for id in stranded {
+            self.preorder_visit(&id, 0, &mut visited, &mut out);
+        }
+        out
+    }
+
+    /// Pre-order DFS from `id`, recording `(id, depth)`; cycle-safe via `visited`.
+    fn preorder_visit(
+        &self,
+        id: &StyleId,
+        depth: usize,
+        visited: &mut HashSet<StyleId>,
+        out: &mut Vec<(StyleId, usize)>,
+    ) {
+        if !visited.insert(id.clone()) {
+            return;
+        }
+        out.push((id.clone(), depth));
+        for child in self.para_children(id) {
+            self.preorder_visit(&child, depth + 1, visited, out);
+        }
+    }
+
+    /// The **exact set of descendants whose value of a property would change** if
+    /// that property were changed on `base` — the impact preview (Spec 05 §7).
+    ///
+    /// `has_local` reports whether a style sets the property locally (e.g.
+    /// `|s| s.para_props.alignment.is_some()`). A descendant `D` is affected iff
+    /// no style *strictly between* `D` and `base` (inclusive of `D`, exclusive of
+    /// `base`) overrides the property — i.e. `D` currently inherits the property
+    /// from `base`, or would newly pick it up from `base`. Descendants shadowed
+    /// by a closer override are excluded. Returned in `para_descendants` order.
+    #[must_use]
+    pub fn dependents_affected(
+        &self,
+        base: &StyleId,
+        has_local: impl Fn(&ParagraphStyle) -> bool,
+    ) -> Vec<StyleId> {
+        self.para_descendants(base)
+            .into_iter()
+            .filter(|d| self.inherits_property_from(d, base, &has_local))
+            .collect()
+    }
+
+    /// Whether `descendant` reaches `base` without an intervening local override
+    /// of the property tested by `has_local` (walking nearest-first from
+    /// `descendant`). Cycle/depth safety comes from [`Self::para_ancestors`].
+    fn inherits_property_from(
+        &self,
+        descendant: &StyleId,
+        base: &StyleId,
+        has_local: &impl Fn(&ParagraphStyle) -> bool,
+    ) -> bool {
+        for ancestor in self.para_ancestors(descendant) {
+            if &ancestor == base {
+                return true; // reached base with no closer override
+            }
+            if self.paragraph_styles.get(&ancestor).is_some_and(has_local) {
+                return false; // a closer style overrides the property
+            }
+        }
+        false // base is not on the chain (shouldn't happen for a descendant)
+    }
+}
+
+#[cfg(test)]
+#[path = "tree_tests.rs"]
+mod tests;
diff --git a/loki-doc-model/src/style/tree_tests.rs b/loki-doc-model/src/style/tree_tests.rs
new file mode 100644
index 00000000..4a4d0f8c
--- /dev/null
+++ b/loki-doc-model/src/style/tree_tests.rs
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Paragraph-style hierarchy queries + impact preview (Spec 05 M4).
+
+use super::*;
+use crate::style::props::char_props::CharProps;
+use crate::style::props::para_props::{ParaProps, ParagraphAlignment};
+
+fn para(id: &str, parent: Option<&str>, pp: ParaProps) -> ParagraphStyle {
+    ParagraphStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        linked_char_style: None,
+        next_style_id: None,
+        para_props: pp,
+        char_props: CharProps::default(),
+        is_default: false,
+        is_custom: false,
+        extensions: Default::default(),
+    }
+}
+
+fn aligned(a: ParagraphAlignment) -> ParaProps {
+    ParaProps {
+        alignment: Some(a),
+        ..Default::default()
+    }
+}
+
+fn insert(cat: &mut StyleCatalog, s: ParagraphStyle) {
+    cat.paragraph_styles.insert(s.id.clone(), s);
+}
+
+/// A → { B → { D }, C }
+fn tree_catalog() -> StyleCatalog {
+    let mut c = StyleCatalog::new();
+    insert(&mut c, para("A", None, ParaProps::default()));
+    insert(&mut c, para("B", Some("A"), ParaProps::default()));
+    insert(&mut c, para("C", Some("A"), ParaProps::default()));
+    insert(&mut c, para("D", Some("B"), ParaProps::default()));
+    c
+}
+
+fn ids(v: &[StyleId]) -> Vec<&str> {
+    v.iter().map(StyleId::as_str).collect()
+}
+
+#[test]
+fn children_lists_direct_descendants_only() {
+    let c = tree_catalog();
+    assert_eq!(ids(&c.para_children(&StyleId::new("A"))), vec!["B", "C"]);
+    assert_eq!(ids(&c.para_children(&StyleId::new("B"))), vec!["D"]);
+    assert!(c.para_children(&StyleId::new("D")).is_empty());
+}
+
+#[test]
+fn descendants_are_transitive_breadth_first() {
+    let c = tree_catalog();
+    assert_eq!(
+        ids(&c.para_descendants(&StyleId::new("A"))),
+        vec!["B", "C", "D"]
+    );
+    assert_eq!(ids(&c.para_descendants(&StyleId::new("B"))), vec!["D"]);
+    assert!(c.para_descendants(&StyleId::new("D")).is_empty());
+}
+
+#[test]
+fn descendants_terminate_on_a_cycle() {
+    let mut c = StyleCatalog::new();
+    // A → B → A (corrupt). Walk must not loop.
+    insert(&mut c, para("A", Some("B"), ParaProps::default()));
+    insert(&mut c, para("B", Some("A"), ParaProps::default()));
+    let d = c.para_descendants(&StyleId::new("A"));
+    // B is a descendant; A is not listed again (cycle guard).
+    assert_eq!(ids(&d), vec!["B"]);
+}
+
+fn sets_alignment(s: &ParagraphStyle) -> bool {
+    s.para_props.alignment.is_some()
+}
+
+#[test]
+fn impact_preview_lists_dependents_that_inherit_the_property() {
+    // A sets alignment; B & D inherit it; C overrides it locally.
+    let mut c = StyleCatalog::new();
+    insert(&mut c, para("A", None, aligned(ParagraphAlignment::Left)));
+    insert(&mut c, para("B", Some("A"), ParaProps::default()));
+    insert(
+        &mut c,
+        para("C", Some("A"), aligned(ParagraphAlignment::Right)),
+    );
+    insert(&mut c, para("D", Some("B"), ParaProps::default()));
+
+    // Changing alignment on A affects B and D, not C (which overrides).
+    let affected = c.dependents_affected(&StyleId::new("A"), sets_alignment);
+    assert_eq!(ids(&affected), vec!["B", "D"]);
+}
+
+#[test]
+fn impact_preview_excludes_subtrees_shadowed_by_a_closer_override() {
+    // A sets alignment; B overrides it; D is under B.
+    let mut c = StyleCatalog::new();
+    insert(&mut c, para("A", None, aligned(ParagraphAlignment::Left)));
+    insert(
+        &mut c,
+        para("B", Some("A"), aligned(ParagraphAlignment::Center)),
+    );
+    insert(&mut c, para("D", Some("B"), ParaProps::default()));
+
+    // B overrides, so D inherits from B, not A — changing A affects neither.
+    let affected = c.dependents_affected(&StyleId::new("A"), sets_alignment);
+    assert!(
+        affected.is_empty(),
+        "shadowed subtree must be excluded: {:?}",
+        ids(&affected)
+    );
+}
+
+#[test]
+fn impact_preview_covers_adding_a_new_override() {
+    // A does not set alignment yet; B & D inherit from further up / engine.
+    // Adding alignment at A would newly apply to B and D (no closer override).
+    let mut c = StyleCatalog::new();
+    insert(&mut c, para("A", None, ParaProps::default()));
+    insert(&mut c, para("B", Some("A"), ParaProps::default()));
+    insert(&mut c, para("D", Some("B"), ParaProps::default()));
+
+    let affected = c.dependents_affected(&StyleId::new("A"), sets_alignment);
+    assert_eq!(ids(&affected), vec!["B", "D"]);
+}
+
+#[test]
+fn forest_preorder_lists_parents_before_subtrees_with_depths() {
+    let c = tree_catalog();
+    let order = c.para_forest_preorder();
+    let flat: Vec<(&str, usize)> = order.iter().map(|(id, d)| (id.as_str(), *d)).collect();
+    // A(0) then its subtree B(1) → D(2), then C(1).
+    assert_eq!(flat, vec![("A", 0), ("B", 1), ("D", 2), ("C", 1)]);
+}
+
+#[test]
+fn forest_preorder_surfaces_cycle_stranded_styles_once() {
+    let mut c = StyleCatalog::new();
+    // A → B → A: no root. Both must still appear exactly once.
+    insert(&mut c, para("A", Some("B"), ParaProps::default()));
+    insert(&mut c, para("B", Some("A"), ParaProps::default()));
+    let order = c.para_forest_preorder();
+    let mut ids: Vec<&str> = order.iter().map(|(id, _)| id.as_str()).collect();
+    ids.sort_unstable();
+    assert_eq!(ids, vec!["A", "B"]);
+}
+
+#[test]
+fn reparent_cycle_guard_still_holds_for_the_tree_view() {
+    // Sanity: the M1 guard composes with the downward view.
+    let c = tree_catalog();
+    assert!(c.para_reparent_cycles(&StyleId::new("A"), &StyleId::new("D")));
+    assert!(!c.para_reparent_cycles(&StyleId::new("D"), &StyleId::new("C")));
+}
diff --git a/loki-doc-model/tests/loro_bridge_note_tests.rs b/loki-doc-model/tests/loro_bridge_note_tests.rs
new file mode 100644
index 00000000..82380f7d
--- /dev/null
+++ b/loki-doc-model/tests/loro_bridge_note_tests.rs
@@ -0,0 +1,110 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Footnote/endnote bodies as **live CRDT containers** (not JSON blobs in the
+//! mark): the body lives under the block's `KEY_NOTES` container, so it is
+//! editable/mergeable like a table cell, and adjacent notes keep distinct
+//! bodies (their `(kind, idx)` marks do not merge into one span).
+
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{Inline, NoteKind};
+use loki_doc_model::document::Document;
+use loki_doc_model::loro_bridge::{document_to_loro, loro_to_document};
+use loki_doc_model::loro_schema::{KEY_BLOCKS, KEY_NOTES, KEY_SECTIONS};
+
+fn para(text: &str) -> Block {
+    Block::Para(vec![Inline::Str(text.into())])
+}
+
+fn doc_with_block(block: Block) -> Document {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![block];
+    doc
+}
+
+fn round_trip(doc: &Document) -> Document {
+    loro_to_document(&document_to_loro(doc).unwrap()).unwrap()
+}
+
+/// Navigates to the first block's `KEY_NOTES` movable list and returns, for each
+/// entry, whether it is itself a movable list (a live body container) and its
+/// block count. `None` when there is no notes container.
+fn note_bodies_shape(doc: &Document) -> Option<Vec<usize>> {
+    let loro = document_to_loro(doc).unwrap();
+    let sections = loro.get_list(KEY_SECTIONS);
+    let sec = sections.get(0)?.into_container().ok()?.into_map().ok()?;
+    let blocks = sec
+        .get(KEY_BLOCKS)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    let block = blocks.get(0)?.into_container().ok()?.into_map().ok()?;
+    let notes = block
+        .get(KEY_NOTES)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    let mut shape = Vec::new();
+    for i in 0..notes.len() {
+        // Each entry must be a live movable-list container, not a JSON string.
+        let body = notes
+            .get(i)?
+            .into_container()
+            .ok()?
+            .into_movable_list()
+            .ok()?;
+        shape.push(body.len());
+    }
+    Some(shape)
+}
+
+#[test]
+fn note_body_is_a_live_container_not_a_blob() {
+    let block = Block::Para(vec![
+        Inline::Str("see".into()),
+        Inline::Note(NoteKind::Footnote, vec![para("a"), para("b")]),
+    ]);
+    let doc = doc_with_block(block.clone());
+    // One note whose body container holds two blocks.
+    assert_eq!(note_bodies_shape(&doc), Some(vec![2]));
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn two_adjacent_footnotes_keep_distinct_bodies() {
+    // The classic failure mode: identical marks would merge the two anchors
+    // into one delta span. The (kind, idx) mark keeps them distinct.
+    let block = Block::Para(vec![
+        Inline::Str("x".into()),
+        Inline::Note(NoteKind::Footnote, vec![para("first")]),
+        Inline::Note(NoteKind::Footnote, vec![para("second")]),
+        Inline::Str("y".into()),
+    ]);
+    let doc = doc_with_block(block.clone());
+    assert_eq!(note_bodies_shape(&doc), Some(vec![1, 1]));
+    let recovered = round_trip(&doc);
+    assert_eq!(recovered.sections[0].blocks[0], block);
+    let Block::Para(inlines) = &recovered.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    assert_eq!(inlines.len(), 4, "Str, Note, Note, Str: {inlines:?}");
+}
+
+#[test]
+fn mixed_footnote_and_endnote_preserve_kind_and_order() {
+    let block = Block::Para(vec![
+        Inline::Note(NoteKind::Endnote, vec![para("end")]),
+        Inline::Str(" mid ".into()),
+        Inline::Note(NoteKind::Footnote, vec![para("foot")]),
+    ]);
+    let doc = doc_with_block(block.clone());
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn paragraph_without_notes_has_no_notes_container() {
+    let doc = doc_with_block(para("plain text"));
+    assert_eq!(note_bodies_shape(&doc), None);
+}
diff --git a/loki-doc-model/tests/loro_bridge_opaque_tests.rs b/loki-doc-model/tests/loro_bridge_opaque_tests.rs
index d4222c3f..e5a523d7 100644
--- a/loki-doc-model/tests/loro_bridge_opaque_tests.rs
+++ b/loki-doc-model/tests/loro_bridge_opaque_tests.rs
@@ -11,6 +11,9 @@ use loki_doc_model::content::block::{Block, Caption, ListAttributes};
 use loki_doc_model::content::inline::{Inline, LinkTarget, NoteKind, StyledRun};
 use loki_doc_model::document::Document;
 use loki_doc_model::loro_bridge::{derive_loro_cursor, document_to_loro, loro_to_document};
+use loki_doc_model::loro_schema::{
+    BLOCK_TYPE_OPAQUE, BLOCK_TYPE_PARA, KEY_BLOCKS, KEY_SECTIONS, KEY_TYPE,
+};
 use loki_doc_model::style::catalog::StyleId;
 use loki_doc_model::style::props::char_props::{CharProps, HighlightColor};
 
@@ -103,6 +106,143 @@ fn inline_image_paragraph_survives_roundtrip() {
     assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
 }
 
+/// Reads the `KEY_TYPE` discriminator of the first block in the first section
+/// directly from the Loro document, to distinguish a native mapping from an
+/// opaque snapshot.
+fn first_block_type(doc: &Document) -> Option<String> {
+    let loro = document_to_loro(doc).ok()?;
+    let sections = loro.get_list(KEY_SECTIONS);
+    let sec = sections.get(0)?.into_container().ok()?.into_map().ok()?;
+    let blocks = sec
+        .get(KEY_BLOCKS)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    let block = blocks.get(0)?.into_container().ok()?.into_map().ok()?;
+    block
+        .get(KEY_TYPE)?
+        .into_value()
+        .ok()?
+        .into_string()
+        .ok()
+        .map(|s| s.to_string())
+}
+
+/// A bare (top-level) image is mapped natively — a placeholder anchor carrying
+/// the image as a mark — so the paragraph is a live `para`, not an opaque
+/// snapshot, while still round-tripping byte-for-byte.
+#[test]
+fn inline_image_stored_natively_not_opaque() {
+    let block = Block::Para(vec![
+        Inline::Str("see ".into()),
+        Inline::Image(
+            NodeAttr::default(),
+            vec![Inline::Str("alt".into())],
+            LinkTarget::new("media/i.png"),
+        ),
+        Inline::Str(" here".into()),
+    ]);
+    let doc = doc_with_blocks(vec![block.clone()]);
+    assert_eq!(
+        first_block_type(&doc).as_deref(),
+        Some(BLOCK_TYPE_PARA),
+        "an image paragraph must be a native para, not an opaque snapshot"
+    );
+    let recovered = round_trip(&doc);
+    assert_eq!(recovered.sections[0].blocks[0], block);
+    // The image must survive as a discrete, positioned inline (Str, Image, Str).
+    let Block::Para(inlines) = &recovered.sections[0].blocks[0] else {
+        panic!("expected Para");
+    };
+    assert_eq!(
+        inlines.len(),
+        3,
+        "image must stay a discrete inline: {inlines:?}"
+    );
+    assert!(matches!(inlines[1], Inline::Image(..)));
+}
+
+/// An image *nested* inside a wrapper is flattened by the text write path, so
+/// its block must remain an opaque snapshot to avoid silent data loss.
+#[test]
+fn nested_inline_image_stays_opaque_but_survives() {
+    let block = Block::Para(vec![Inline::Strong(vec![Inline::Image(
+        NodeAttr::default(),
+        vec![],
+        LinkTarget::new("media/i.png"),
+    )])]);
+    let doc = doc_with_blocks(vec![block.clone()]);
+    assert_eq!(
+        first_block_type(&doc).as_deref(),
+        Some(BLOCK_TYPE_OPAQUE),
+        "an image nested in a wrapper must keep its block opaque"
+    );
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+/// A bare (top-level) footnote/endnote is mapped natively — its reference is a
+/// placeholder anchor carrying the note (kind + block body) as a mark — so the
+/// paragraph is a live `para`, with the note a discrete inline, and the body
+/// round-trips losslessly.
+#[test]
+fn footnote_stored_natively_not_opaque() {
+    let block = Block::Para(vec![
+        Inline::Str("claim".into()),
+        Inline::Note(
+            NoteKind::Footnote,
+            vec![para("supporting detail"), para("second paragraph")],
+        ),
+        Inline::Str(" continues".into()),
+    ]);
+    let doc = doc_with_blocks(vec![block.clone()]);
+    assert_eq!(
+        first_block_type(&doc).as_deref(),
+        Some(BLOCK_TYPE_PARA),
+        "a footnote paragraph must be a native para, not an opaque snapshot"
+    );
+    let recovered = round_trip(&doc);
+    assert_eq!(recovered.sections[0].blocks[0], block);
+    let Block::Para(inlines) = &recovered.sections[0].blocks[0] else {
+        panic!("expected Para");
+    };
+    assert_eq!(
+        inlines.len(),
+        3,
+        "note must stay a discrete inline: {inlines:?}"
+    );
+    assert!(matches!(inlines[1], Inline::Note(NoteKind::Footnote, _)));
+}
+
+/// Endnotes use the same path; the `NoteKind` discriminant must survive.
+#[test]
+fn endnote_kind_survives_native_roundtrip() {
+    let block = Block::Para(vec![Inline::Note(
+        NoteKind::Endnote,
+        vec![para("endnote body")],
+    )]);
+    let doc = doc_with_blocks(vec![block.clone()]);
+    assert_eq!(first_block_type(&doc).as_deref(), Some(BLOCK_TYPE_PARA));
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+/// A note *nested* inside a wrapper is flattened by the text write path, so its
+/// block must remain an opaque snapshot to avoid silent data loss.
+#[test]
+fn nested_footnote_stays_opaque_but_survives() {
+    let block = Block::Para(vec![Inline::Emph(vec![Inline::Note(
+        NoteKind::Footnote,
+        vec![para("body")],
+    )])]);
+    let doc = doc_with_blocks(vec![block.clone()]);
+    assert_eq!(
+        first_block_type(&doc).as_deref(),
+        Some(BLOCK_TYPE_OPAQUE),
+        "a note nested in a wrapper must keep its block opaque"
+    );
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
 // ── C2: text-bearing inline variants keep text and formatting ───────────────
 
 /// Collects all visible text of a block's inlines, descending into runs.
diff --git a/loki-doc-model/tests/loro_bridge_table_tests.rs b/loki-doc-model/tests/loro_bridge_table_tests.rs
new file mode 100644
index 00000000..752805a2
--- /dev/null
+++ b/loki-doc-model/tests/loro_bridge_table_tests.rs
@@ -0,0 +1,258 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Native table mapping: `Block::Table` round-trips through the Loro bridge as
+//! a structural skeleton plus live per-cell block lists (not an opaque blob),
+//! so cell text is real CRDT state. Covers round-trip fidelity, native storage
+//! (`KEY_TYPE == "table"`), the live cell-content containers, rich/empty cells,
+//! spans + cell properties, and a table nested inside a cell.
+
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::Inline;
+use loki_doc_model::content::table::col::ColAlignment;
+use loki_doc_model::content::table::row::{Cell, CellProps, CellVerticalAlign};
+use loki_doc_model::content::table::{
+    ColSpec, Row, Table, TableBody, TableCaption, TableFoot, TableHead, TableWidth,
+};
+use loki_doc_model::document::Document;
+use loki_doc_model::loro_bridge::{document_to_loro, loro_to_document};
+use loki_doc_model::loro_schema::{
+    BLOCK_TYPE_TABLE, KEY_BLOCKS, KEY_SECTIONS, KEY_TABLE_CELLS, KEY_TYPE,
+};
+use loki_primitives::units::Points;
+
+fn round_trip(doc: &Document) -> Document {
+    let loro = document_to_loro(doc).expect("document_to_loro must succeed");
+    loro_to_document(&loro).expect("loro_to_document must succeed")
+}
+
+fn doc_with_block(block: Block) -> Document {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![block];
+    doc
+}
+
+fn para(text: &str) -> Block {
+    Block::Para(vec![Inline::Str(text.into())])
+}
+
+fn text_cell(text: &str) -> Cell {
+    Cell::simple(vec![para(text)])
+}
+
+/// A 2-column table: one header row + two body rows = 6 cells.
+fn sample_table() -> Table {
+    Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: Some(TableWidth::Percent(100.0)),
+        col_specs: vec![
+            ColSpec::fixed(Points::new(72.0)),
+            ColSpec::fixed(Points::new(144.0)),
+        ],
+        head: TableHead {
+            attr: NodeAttr::default(),
+            rows: vec![Row::new(vec![text_cell("H1"), text_cell("H2")])],
+        },
+        bodies: vec![TableBody::from_rows(vec![
+            Row::new(vec![text_cell("a"), text_cell("b")]),
+            Row::new(vec![text_cell("c"), text_cell("d")]),
+        ])],
+        foot: TableFoot::empty(),
+    }
+}
+
+/// Reads the `KEY_TYPE` of the first block directly from the Loro document.
+fn first_block_type(doc: &Document) -> Option<String> {
+    let loro = document_to_loro(doc).ok()?;
+    let sections = loro.get_list(KEY_SECTIONS);
+    let sec = sections.get(0)?.into_container().ok()?.into_map().ok()?;
+    let blocks = sec
+        .get(KEY_BLOCKS)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    let block = blocks.get(0)?.into_container().ok()?.into_map().ok()?;
+    block
+        .get(KEY_TYPE)?
+        .into_value()
+        .ok()?
+        .into_string()
+        .ok()
+        .map(|s| s.to_string())
+}
+
+/// Counts the live per-cell content lists under `KEY_TABLE_CELLS`.
+fn table_cell_list_len(doc: &Document) -> Option<usize> {
+    let loro = document_to_loro(doc).ok()?;
+    let sections = loro.get_list(KEY_SECTIONS);
+    let sec = sections.get(0)?.into_container().ok()?.into_map().ok()?;
+    let blocks = sec
+        .get(KEY_BLOCKS)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    let block = blocks.get(0)?.into_container().ok()?.into_map().ok()?;
+    let cells = block
+        .get(KEY_TABLE_CELLS)?
+        .into_container()
+        .ok()?
+        .into_movable_list()
+        .ok()?;
+    Some(cells.len())
+}
+
+#[test]
+fn table_stored_natively_not_opaque() {
+    let block = Block::Table(Box::new(sample_table()));
+    let doc = doc_with_block(block.clone());
+    assert_eq!(
+        first_block_type(&doc).as_deref(),
+        Some(BLOCK_TYPE_TABLE),
+        "a table must be a native table block, not an opaque snapshot"
+    );
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn table_cells_are_separate_live_containers() {
+    let doc = doc_with_block(Block::Table(Box::new(sample_table())));
+    // 1 header row (2 cells) + 2 body rows (2 cells each) = 6 cells.
+    assert_eq!(table_cell_list_len(&doc), Some(6));
+}
+
+#[test]
+fn table_rich_cell_content_round_trips() {
+    // A cell with multiple blocks and inline formatting. Cell text is live CRDT
+    // state, so formatting survives — but, exactly as at the top level, the
+    // bridge normalises `Strong` to a bold `StyledRun`, so we assert structure
+    // and the bold run rather than byte-for-byte equality.
+    let rich = Cell::simple(vec![
+        Block::Heading(2, NodeAttr::default(), vec![Inline::Str("Title".into())]),
+        Block::Para(vec![
+            Inline::Str("see ".into()),
+            Inline::Strong(vec![Inline::Str("this".into())]),
+        ]),
+    ]);
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![ColSpec::fixed(Points::new(72.0))],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![rich])])],
+        foot: TableFoot::empty(),
+    };
+    let doc = doc_with_block(Block::Table(Box::new(table)));
+    assert_eq!(first_block_type(&doc).as_deref(), Some(BLOCK_TYPE_TABLE));
+
+    let recovered = round_trip(&doc);
+    let Block::Table(t) = &recovered.sections[0].blocks[0] else {
+        panic!("expected a table");
+    };
+    let cell = &t.bodies[0].body_rows[0].cells[0];
+    assert_eq!(cell.blocks.len(), 2, "cell must keep both blocks");
+    assert!(matches!(&cell.blocks[0], Block::Heading(2, _, _)));
+    let Block::Para(inlines) = &cell.blocks[1] else {
+        panic!("expected a paragraph");
+    };
+    let has_bold = inlines.iter().any(|i| {
+        matches!(i, Inline::StyledRun(r)
+            if r.direct_props.as_ref().is_some_and(|p| p.bold == Some(true)))
+    });
+    assert!(
+        has_bold,
+        "bold formatting must survive in the cell: {inlines:?}"
+    );
+}
+
+#[test]
+fn table_spans_and_cell_props_round_trip() {
+    // A cell carrying a col-span, row-span, alignment, and cell properties —
+    // all structural metadata that must survive in the skeleton.
+    let spanning = Cell {
+        attr: NodeAttr::default(),
+        alignment: ColAlignment::Center,
+        row_span: 2,
+        col_span: 2,
+        blocks: vec![para("merged")],
+        props: CellProps {
+            vertical_align: Some(CellVerticalAlign::Middle),
+            ..Default::default()
+        },
+    };
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption {
+            short: None,
+            full: vec![Inline::Str("A caption".into())],
+        },
+        width: Some(TableWidth::Fixed(360.0)),
+        col_specs: vec![
+            ColSpec::fixed(Points::new(72.0)),
+            ColSpec::fixed(Points::new(72.0)),
+        ],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![spanning])])],
+        foot: TableFoot::empty(),
+    };
+    let block = Block::Table(Box::new(table));
+    let doc = doc_with_block(block.clone());
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn nested_table_in_cell_round_trips() {
+    // A table whose cell contains another table — proves the cell block path
+    // recurses through the native table mapping.
+    let inner = Block::Table(Box::new(sample_table()));
+    let outer = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![ColSpec::fixed(Points::new(200.0))],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![Cell::simple(
+            vec![para("outer"), inner],
+        )])])],
+        foot: TableFoot::empty(),
+    };
+    let block = Block::Table(Box::new(outer));
+    let doc = doc_with_block(block.clone());
+    assert_eq!(first_block_type(&doc).as_deref(), Some(BLOCK_TYPE_TABLE));
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn empty_table_round_trips_natively() {
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![],
+        head: TableHead::empty(),
+        bodies: vec![],
+        foot: TableFoot::empty(),
+    };
+    let block = Block::Table(Box::new(table));
+    let doc = doc_with_block(block.clone());
+    assert_eq!(first_block_type(&doc).as_deref(), Some(BLOCK_TYPE_TABLE));
+    assert_eq!(table_cell_list_len(&doc), Some(0));
+    assert_eq!(round_trip(&doc).sections[0].blocks[0], block);
+}
+
+#[test]
+fn table_among_paragraphs_keeps_position() {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![
+        para("before"),
+        Block::Table(Box::new(sample_table())),
+        para("after"),
+    ];
+    let recovered = round_trip(&doc);
+    assert_eq!(recovered.sections[0].blocks.len(), 3);
+    assert_eq!(recovered.sections[0].blocks, doc.sections[0].blocks);
+}
diff --git a/loki-doc-model/tests/loro_mutation_insert_tests.rs b/loki-doc-model/tests/loro_mutation_insert_tests.rs
new file mode 100644
index 00000000..92dcc42b
--- /dev/null
+++ b/loki-doc-model/tests/loro_mutation_insert_tests.rs
@@ -0,0 +1,184 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Insert primitives for the editor's Insert tab: `insert_block_after`
+//! (Insert → Table) and `insert_inline_note_at` (Insert → Footnote). Both write
+//! the bridge's own schema against a live document, so the inserted object
+//! round-trips through `loro_to_document` and its nested content (table cells /
+//! note body) is reachable for editing via a `BlockPath`.
+
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{Inline, NoteKind};
+use loki_doc_model::content::table::core::Table;
+use loki_doc_model::document::Document;
+use loki_doc_model::loro_bridge::{document_to_loro, loro_to_document};
+use loki_doc_model::{
+    BlockPath, PathStep, get_block_text_at, insert_block_after, insert_inline_note_at,
+    insert_text_at,
+};
+
+fn doc_with_paragraph(text: &str) -> Document {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Para(vec![Inline::Str(text.into())])];
+    doc
+}
+
+fn para_text(inlines: &[Inline]) -> String {
+    inlines
+        .iter()
+        .filter_map(|i| match i {
+            Inline::Str(s) => Some(s.as_str()),
+            _ => None,
+        })
+        .collect()
+}
+
+// ── Table::grid + insert_block_after ────────────────────────────────────────
+
+#[test]
+fn grid_builds_evenly_proportioned_empty_cells() {
+    let t = Table::grid(2, 3);
+    assert_eq!(t.col_count(), 3);
+    assert_eq!(t.bodies[0].body_rows.len(), 2);
+    assert_eq!(t.bodies[0].body_rows[0].cells.len(), 3);
+    // Each cell is a single empty paragraph (immediately editable).
+    assert_eq!(
+        t.bodies[0].body_rows[0].cells[0].blocks,
+        vec![Block::Para(Vec::new())]
+    );
+}
+
+#[test]
+fn grid_clamps_dimensions_to_at_least_one() {
+    let t = Table::grid(0, 0);
+    assert_eq!(t.col_count(), 1);
+    assert_eq!(t.bodies[0].body_rows.len(), 1);
+}
+
+#[test]
+fn insert_block_after_adds_a_table_that_round_trips() {
+    let loro = document_to_loro(&doc_with_paragraph("hello")).unwrap();
+    let new_index =
+        insert_block_after(&loro, 0, &Block::Table(Box::new(Table::grid(2, 2)))).unwrap();
+    assert_eq!(new_index, 1, "table lands right after the paragraph");
+
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(rebuilt.sections[0].blocks.len(), 2);
+    let Block::Para(p) = &rebuilt.sections[0].blocks[0] else {
+        panic!("block 0 stays the paragraph");
+    };
+    assert_eq!(para_text(p), "hello");
+    assert!(
+        matches!(rebuilt.sections[0].blocks[1], Block::Table(_)),
+        "block 1 is the inserted table"
+    );
+}
+
+#[test]
+fn inserted_table_cells_are_live_editable_containers() {
+    let loro = document_to_loro(&doc_with_paragraph("x")).unwrap();
+    insert_block_after(&loro, 0, &Block::Table(Box::new(Table::grid(1, 2)))).unwrap();
+    // The table is block 1; its first cell starts empty and accepts text.
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_cell(1, 0, 0)), "");
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 0, "hi").unwrap();
+
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Table(t) = &rebuilt.sections[0].blocks[1] else {
+        panic!("table");
+    };
+    let Block::Para(cell0) = &t.bodies[0].body_rows[0].cells[0].blocks[0] else {
+        panic!("cell para");
+    };
+    assert_eq!(para_text(cell0), "hi");
+}
+
+// ── insert_inline_note_at ───────────────────────────────────────────────────
+
+#[test]
+fn insert_footnote_at_cursor_round_trips_with_body() {
+    let loro = document_to_loro(&doc_with_paragraph("abc")).unwrap();
+    let body = vec![Block::Para(vec![Inline::Str("note".into())])];
+    insert_inline_note_at(&loro, &BlockPath::block(0), 3, &NoteKind::Footnote, &body).unwrap();
+
+    // The note's body is a live container, addressable and editable.
+    assert_eq!(
+        get_block_text_at(&loro, &BlockPath::in_note(0, 0, 0)),
+        "note"
+    );
+
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Para(inlines) = &rebuilt.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    let note = inlines
+        .iter()
+        .find_map(|i| match i {
+            Inline::Note(kind, body) => Some((kind, body)),
+            _ => None,
+        })
+        .expect("note inline present");
+    assert_eq!(*note.0, NoteKind::Footnote);
+    let Block::Para(bp) = &note.1[0] else {
+        panic!("note body para");
+    };
+    assert_eq!(para_text(bp), "note");
+}
+
+#[test]
+fn inserted_empty_footnote_body_accepts_typing() {
+    let loro = document_to_loro(&doc_with_paragraph("ref")).unwrap();
+    // The editor inserts a footnote with one empty paragraph, then the user types.
+    insert_inline_note_at(
+        &loro,
+        &BlockPath::block(0),
+        3,
+        &NoteKind::Footnote,
+        &[Block::Para(Vec::new())],
+    )
+    .unwrap();
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_note(0, 0, 0)), "");
+    insert_text_at(&loro, &BlockPath::in_note(0, 0, 0), 0, "typed").unwrap();
+
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Para(inlines) = &rebuilt.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    let body = inlines
+        .iter()
+        .find_map(|i| match i {
+            Inline::Note(_, b) => Some(b),
+            _ => None,
+        })
+        .expect("note");
+    let Block::Para(bp) = &body[0] else {
+        panic!("body para");
+    };
+    assert_eq!(para_text(bp), "typed");
+}
+
+#[test]
+fn insert_footnote_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_paragraph("x")).unwrap();
+    insert_block_after(&loro, 0, &Block::Table(Box::new(Table::grid(1, 1)))).unwrap();
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 0, "c").unwrap();
+
+    // Insert a footnote after the cell's "c"; the note descends Cell → Note.
+    let cell_path = BlockPath::in_cell(1, 0, 0);
+    insert_inline_note_at(
+        &loro,
+        &cell_path,
+        1,
+        &NoteKind::Footnote,
+        &[Block::Para(vec![Inline::Str("fn".into())])],
+    )
+    .unwrap();
+
+    let nested = BlockPath {
+        root: 1,
+        steps: vec![
+            PathStep::Cell { cell: 0, block: 0 },
+            PathStep::Note { note: 0, block: 0 },
+        ],
+    };
+    assert_eq!(get_block_text_at(&loro, &nested), "fn");
+}
diff --git a/loki-doc-model/tests/loro_mutation_nested_tests.rs b/loki-doc-model/tests/loro_mutation_nested_tests.rs
new file mode 100644
index 00000000..51cdb852
--- /dev/null
+++ b/loki-doc-model/tests/loro_mutation_nested_tests.rs
@@ -0,0 +1,429 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Nested-addressing mutations: editing text inside table cells and
+//! footnote/endnote bodies via a [`BlockPath`] (including a recursive
+//! cell → note path), proving the live containers are reachable and that edits
+//! round-trip through `loro_to_document` (the bridge rebuilds each cell / note
+//! body from the same containers).
+
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{Inline, NoteKind};
+use loki_doc_model::content::table::core::{Table, TableBody, TableCaption, TableFoot, TableHead};
+use loki_doc_model::content::table::row::{Cell, Row};
+use loki_doc_model::document::Document;
+use loki_doc_model::loro_bridge::{document_to_loro, loro_to_document};
+use loki_doc_model::loro_schema::MARK_BOLD;
+use loki_doc_model::{
+    BlockPath, MutationError, PathStep, delete_text_at, get_block_text_at, insert_text_at,
+    mark_text_at, merge_block_at, split_block_at,
+};
+use loro::LoroValue;
+
+fn text_cell(s: &str) -> Cell {
+    Cell::simple(vec![Block::Para(vec![Inline::Str(s.into())])])
+}
+
+/// Plain text of every paragraph block in the `cell`-th cell of the table at
+/// global block index 1 of a rebuilt document.
+fn cell_block_texts(doc: &Document, cell: usize) -> Vec<String> {
+    let Block::Table(t) = &doc.sections[0].blocks[1] else {
+        panic!("expected a table");
+    };
+    t.bodies[0].body_rows[0].cells[cell]
+        .blocks
+        .iter()
+        .map(|b| match b {
+            Block::Para(inlines) => inlines
+                .iter()
+                .filter_map(|i| match i {
+                    Inline::Str(s) => Some(s.as_str()),
+                    _ => None,
+                })
+                .collect(),
+            _ => String::new(),
+        })
+        .collect()
+}
+
+/// `[Para("intro"), Table]` — the table is global block index 1, with one body
+/// row of two cells "a" | "b" (flat cell indices 0 and 1).
+fn doc_with_table() -> Document {
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![
+            text_cell("a"),
+            text_cell("b"),
+        ])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![
+        Block::Para(vec![Inline::Str("intro".into())]),
+        Block::Table(Box::new(table)),
+    ];
+    doc
+}
+
+/// Returns the first paragraph's text in the `cell`-th cell of the table at
+/// global block index 1 of a rebuilt document.
+fn cell_para_text(doc: &Document, cell: usize) -> String {
+    let Block::Table(t) = &doc.sections[0].blocks[1] else {
+        panic!("expected a table");
+    };
+    let cells = &t.bodies[0].body_rows[0].cells;
+    let Block::Para(inlines) = &cells[cell].blocks[0] else {
+        panic!("expected a paragraph");
+    };
+    inlines
+        .iter()
+        .map(|i| match i {
+            Inline::Str(s) => s.as_str(),
+            _ => "",
+        })
+        .collect()
+}
+
+#[test]
+fn reads_text_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_cell(1, 0, 0)), "a");
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_cell(1, 1, 0)), "b");
+}
+
+#[test]
+fn inserts_text_inside_a_table_cell_and_round_trips() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Append to the second cell ("b" -> "bX"); first cell untouched.
+    insert_text_at(&loro, &BlockPath::in_cell(1, 1, 0), 1, "X").unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(cell_para_text(&rebuilt, 1), "bX");
+    assert_eq!(cell_para_text(&rebuilt, 0), "a");
+}
+
+#[test]
+fn deletes_text_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 1, "bcd").unwrap(); // "a" -> "abcd"
+    delete_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 1, 2).unwrap(); // -> "ad"
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(cell_para_text(&rebuilt, 0), "ad");
+}
+
+#[test]
+fn marks_text_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    mark_text_at(
+        &loro,
+        &BlockPath::in_cell(1, 0, 0),
+        0,
+        1,
+        MARK_BOLD,
+        LoroValue::Bool(true),
+    )
+    .unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Table(t) = &rebuilt.sections[0].blocks[1] else {
+        panic!("table");
+    };
+    let Block::Para(inlines) = &t.bodies[0].body_rows[0].cells[0].blocks[0] else {
+        panic!("para");
+    };
+    let bold = inlines.iter().any(|i| {
+        matches!(i, Inline::StyledRun(r)
+            if r.direct_props.as_ref().is_some_and(|p| p.bold == Some(true)))
+    });
+    assert!(bold, "cell text should be bold: {inlines:?}");
+}
+
+#[test]
+fn flat_path_matches_the_flat_api() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Root-only path edits the top-level "intro" paragraph (global block 0).
+    insert_text_at(&loro, &BlockPath::block(0), 5, "!").unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Para(inlines) = &rebuilt.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    assert_eq!(
+        inlines
+            .iter()
+            .filter_map(|i| match i {
+                Inline::Str(s) => Some(s.as_str()),
+                _ => None,
+            })
+            .collect::<String>(),
+        "intro!"
+    );
+}
+
+#[test]
+fn descending_into_a_non_table_block_errors() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Block 0 is a paragraph, not a table.
+    let err = insert_text_at(&loro, &BlockPath::in_cell(0, 0, 0), 0, "x");
+    assert!(matches!(err, Err(MutationError::InvalidBlockPath(_))));
+}
+
+#[test]
+fn out_of_range_cell_errors() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    let err = insert_text_at(&loro, &BlockPath::in_cell(1, 9, 0), 0, "x");
+    assert!(matches!(err, Err(MutationError::InvalidBlockPath(_))));
+}
+
+// ── Note-body addressing ────────────────────────────────────────────────────
+
+fn note_para(text: &str, note_bodies: Vec<(&str, &str)>) -> Block {
+    // A paragraph: leading text, then one footnote per (refless, body) pair.
+    let mut inlines = vec![Inline::Str(text.into())];
+    for (_, body) in note_bodies {
+        inlines.push(Inline::Note(
+            NoteKind::Footnote,
+            vec![Block::Para(vec![Inline::Str(body.into())])],
+        ));
+    }
+    Block::Para(inlines)
+}
+
+/// Plain text of the `note_ord`-th note's first body paragraph in block
+/// `para_block` of a rebuilt document.
+fn note_body_text(doc: &Document, para_block: usize, note_ord: usize) -> String {
+    let Block::Para(inlines) = &doc.sections[0].blocks[para_block] else {
+        panic!("para");
+    };
+    let bodies: Vec<&Vec<Block>> = inlines
+        .iter()
+        .filter_map(|i| match i {
+            Inline::Note(_, body) => Some(body),
+            _ => None,
+        })
+        .collect();
+    let Block::Para(binlines) = &bodies[note_ord][0] else {
+        panic!("body para");
+    };
+    binlines
+        .iter()
+        .filter_map(|i| match i {
+            Inline::Str(s) => Some(s.as_str()),
+            _ => None,
+        })
+        .collect()
+}
+
+#[test]
+fn reads_text_inside_a_note_body() {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![note_para("ref", vec![("", "body")])];
+    let loro = document_to_loro(&doc).unwrap();
+    assert_eq!(
+        get_block_text_at(&loro, &BlockPath::in_note(0, 0, 0)),
+        "body"
+    );
+}
+
+#[test]
+fn edits_text_inside_a_note_body_and_round_trips() {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![note_para("ref", vec![("", "body")])];
+    let loro = document_to_loro(&doc).unwrap();
+    insert_text_at(&loro, &BlockPath::in_note(0, 0, 0), 4, "!").unwrap(); // "body" -> "body!"
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(note_body_text(&rebuilt, 0, 0), "body!");
+}
+
+#[test]
+fn addresses_the_correct_note_among_several() {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![note_para("x", vec![("", "first"), ("", "second")])];
+    let loro = document_to_loro(&doc).unwrap();
+    // Edit the *second* note's body only.
+    insert_text_at(&loro, &BlockPath::in_note(0, 1, 0), 6, "!").unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(note_body_text(&rebuilt, 0, 0), "first");
+    assert_eq!(note_body_text(&rebuilt, 0, 1), "second!");
+}
+
+#[test]
+fn descending_into_a_block_without_notes_errors() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Block 0 is a plain paragraph with no notes container.
+    let err = insert_text_at(&loro, &BlockPath::in_note(0, 0, 0), 0, "x");
+    assert!(matches!(err, Err(MutationError::InvalidBlockPath(_))));
+}
+
+#[test]
+fn edits_a_note_nested_inside_a_table_cell() {
+    // A table whose single cell holds a paragraph containing a footnote — the
+    // path descends Cell then Note, proving recursive container addressing.
+    let cell = Cell::simple(vec![Block::Para(vec![
+        Inline::Str("c".into()),
+        Inline::Note(
+            NoteKind::Footnote,
+            vec![Block::Para(vec![Inline::Str("fn".into())])],
+        ),
+    ])]);
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![cell])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Table(Box::new(table))];
+    let loro = document_to_loro(&doc).unwrap();
+
+    let path = BlockPath {
+        root: 0,
+        steps: vec![
+            PathStep::Cell { cell: 0, block: 0 },
+            PathStep::Note { note: 0, block: 0 },
+        ],
+    };
+    assert_eq!(get_block_text_at(&loro, &path), "fn");
+    insert_text_at(&loro, &path, 2, "!").unwrap(); // "fn" -> "fn!"
+
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let Block::Table(t) = &rebuilt.sections[0].blocks[0] else {
+        panic!("table");
+    };
+    let Block::Para(cell_inlines) = &t.bodies[0].body_rows[0].cells[0].blocks[0] else {
+        panic!("cell para");
+    };
+    let body = cell_inlines
+        .iter()
+        .find_map(|i| match i {
+            Inline::Note(_, b) => Some(b),
+            _ => None,
+        })
+        .expect("note in cell");
+    let Block::Para(binlines) = &body[0] else {
+        panic!("note body para");
+    };
+    let text: String = binlines
+        .iter()
+        .filter_map(|i| match i {
+            Inline::Str(s) => Some(s.as_str()),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(text, "fn!");
+}
+
+// ── Path-aware split / merge ────────────────────────────────────────────────
+
+/// Table at global block index 1 whose first body cell (flat index 0) holds two
+/// paragraphs "a" and "b"; the second cell holds "z".
+fn doc_with_two_block_cell() -> Document {
+    let cell = Cell::simple(vec![
+        Block::Para(vec![Inline::Str("a".into())]),
+        Block::Para(vec![Inline::Str("b".into())]),
+    ]);
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![
+            cell,
+            text_cell("z"),
+        ])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![
+        Block::Para(vec![Inline::Str("intro".into())]),
+        Block::Table(Box::new(table)),
+    ];
+    doc
+}
+
+#[test]
+fn splits_a_paragraph_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Cell 0 is "a"; extend to "ab" then split between them.
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 1, "b").unwrap();
+    split_block_at(&loro, &BlockPath::in_cell(1, 0, 0), 1).unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(cell_block_texts(&rebuilt, 0), vec!["a", "b"]);
+    // The sibling cell is untouched (still a single "b" paragraph).
+    assert_eq!(cell_block_texts(&rebuilt, 1), vec!["b"]);
+}
+
+#[test]
+fn split_at_addresses_the_new_sibling_block() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 0), 1, "b").unwrap(); // "ab"
+    split_block_at(&loro, &BlockPath::in_cell(1, 0, 0), 1).unwrap();
+    // The tail moved to block 1 of the cell; it is now live and editable.
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_cell(1, 0, 1)), "b");
+    insert_text_at(&loro, &BlockPath::in_cell(1, 0, 1), 1, "X").unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(cell_block_texts(&rebuilt, 0), vec!["a", "bX"]);
+}
+
+#[test]
+fn split_at_with_a_flat_path_matches_split_block() {
+    let loro = document_to_loro(&doc_with_table()).unwrap();
+    // Root-only path splits the top-level "intro" paragraph (global block 0).
+    split_block_at(&loro, &BlockPath::block(0), 2).unwrap();
+    let rebuilt = loro_to_document(&loro).unwrap();
+    let texts: Vec<String> = rebuilt.sections[0].blocks[..2]
+        .iter()
+        .filter_map(|b| match b {
+            Block::Para(inlines) => Some(
+                inlines
+                    .iter()
+                    .filter_map(|i| match i {
+                        Inline::Str(s) => Some(s.as_str()),
+                        _ => None,
+                    })
+                    .collect(),
+            ),
+            _ => None,
+        })
+        .collect();
+    assert_eq!(texts, vec!["in", "tro"]);
+}
+
+#[test]
+fn merges_a_paragraph_inside_a_table_cell() {
+    let loro = document_to_loro(&doc_with_two_block_cell()).unwrap();
+    // Merge block 1 ("b") into block 0 ("a") of the first cell.
+    let offset = merge_block_at(&loro, &BlockPath::in_cell(1, 0, 1)).unwrap();
+    assert_eq!(offset, 1); // join point = prior length of "a"
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(cell_block_texts(&rebuilt, 0), vec!["ab"]);
+    assert_eq!(cell_block_texts(&rebuilt, 1), vec!["z"]);
+}
+
+#[test]
+fn merge_at_first_block_of_a_cell_has_no_previous() {
+    let loro = document_to_loro(&doc_with_two_block_cell()).unwrap();
+    // Block 0 is the first of its container — no sibling to merge into.
+    let err = merge_block_at(&loro, &BlockPath::in_cell(1, 0, 0));
+    assert!(matches!(err, Err(MutationError::NoPreviousBlock)));
+}
+
+#[test]
+fn split_then_merge_inside_a_note_body_round_trips() {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![note_para("ref", vec![("", "body")])];
+    let loro = document_to_loro(&doc).unwrap();
+    // Split "body" into "bo" | "dy", then merge them back.
+    split_block_at(&loro, &BlockPath::in_note(0, 0, 0), 2).unwrap();
+    assert_eq!(get_block_text_at(&loro, &BlockPath::in_note(0, 0, 1)), "dy");
+    let offset = merge_block_at(&loro, &BlockPath::in_note(0, 0, 1)).unwrap();
+    assert_eq!(offset, 2);
+    let rebuilt = loro_to_document(&loro).unwrap();
+    assert_eq!(note_body_text(&rebuilt, 0, 0), "body");
+}
diff --git a/loki-headless/src/main.rs b/loki-headless/src/main.rs
index c1c572dd..82a468ce 100644
--- a/loki-headless/src/main.rs
+++ b/loki-headless/src/main.rs
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
+#![forbid(unsafe_code)]
+
 //! `loki-headless` — GPU-free printing and file conversion (headless spec
 //! §3). The standalone CLI is the "office printing" deployment: no server,
 //! no Postgres, just files in, PDF/converted files or IPP print jobs out.
diff --git a/loki-i18n/Cargo.toml b/loki-i18n/Cargo.toml
index 60673a8b..46cc041f 100644
--- a/loki-i18n/Cargo.toml
+++ b/loki-i18n/Cargo.toml
@@ -11,6 +11,8 @@ fluent = "0.17"
 # fluent-bundle is pulled transitively by fluent; declare explicitly to
 # access fluent_bundle::concurrent::FluentBundle which is Send + Sync.
 fluent-bundle = "0.16"
-unic-langid = "0.9"
+# `macros` for `langid!` — compile-time `LanguageIdentifier` construction so the
+# built-in `en-US` fallback needs no runtime parse/expect (audit A-5).
+unic-langid = { version = "0.9", features = ["macros"] }
 sys-locale = "0.3"
 rust-embed = { version = "8", features = ["debug-embed"] }
diff --git a/loki-i18n/i18n/en-US/editor.ftl b/loki-i18n/i18n/en-US/editor.ftl
index 099be4fd..2d40c46f 100644
--- a/loki-i18n/i18n/en-US/editor.ftl
+++ b/loki-i18n/i18n/en-US/editor.ftl
@@ -46,6 +46,21 @@ editor-font-substitution-title = Font Substitution
 editor-font-substitution-message = Some fonts in this document are not available and were substituted. Layout and formatting might differ from Office 365.
 editor-font-substitution-download = Download original fonts:
 editor-font-dismiss = Dismiss
+# Compact chip + recovery indicator (one concise line)
+editor-font-substitution-chip = { $count ->
+    [one] 1 font substituted
+   *[other] { $count } fonts substituted
+}
+editor-font-substitution-details = Details
+editor-font-substitution-collapse = Hide
+# Per-substitution card / row
+editor-font-substitution-requested = Requested
+editor-font-substitution-substitute = Substitute
+editor-font-substitution-missing = Missing — no substitute
+# Severity
+editor-font-substitution-compatible = Metric-compatible
+editor-font-substitution-approx = Layout may shift
+editor-font-download-original = Download original
 
 # Save
 editor-save-success = Document saved
@@ -108,3 +123,15 @@ editor-spelling-downloading = Downloading…
 editor-spelling-download-ok = Downloaded and activated
 editor-spelling-download-failed = Download failed
 editor-spelling-load-failed = Could not load dictionary
+
+# Insert → Image (Spec 04 M4) — status banner messages
+editor-insert-image-success = Image inserted
+editor-insert-image-unsupported = Unsupported image format
+editor-insert-image-no-cursor = Place the cursor in the text, then insert the image
+editor-insert-image-error = Could not insert image: { $reason }
+
+# Insert → Table / Footnote (Spec 04 M4) — status banner messages
+editor-insert-table-success = Table inserted
+editor-insert-footnote-success = Footnote inserted
+editor-insert-no-cursor = Place the cursor in the document first
+editor-insert-failed = Could not insert here
diff --git a/loki-i18n/i18n/en-US/ribbon.ftl b/loki-i18n/i18n/en-US/ribbon.ftl
index 13243ab6..758203f8 100644
--- a/loki-i18n/i18n/en-US/ribbon.ftl
+++ b/loki-i18n/i18n/en-US/ribbon.ftl
@@ -1,9 +1,11 @@
 # Ribbon tabs and controls.
 
 # Tab labels
-ribbon-tab-home = Home
+# The ribbon's primary tab is "Write" (renamed from "Home" — Spec 04 D1 — to
+# resolve the collision with the application Home *screen*).
+ribbon-tab-write = Write
 
-# Inline formatting group (Home tab)
+# Inline formatting group (Write tab)
 ribbon-group-inline = Inline formatting
 ribbon-bold-aria = Bold (Ctrl+B)
 ribbon-italic-aria = Italic (Ctrl+I)
@@ -44,6 +46,24 @@ ribbon-style-editor-heading = Edit Style
 ribbon-style-new-aria = New custom style
 ribbon-style-apply-changes = Apply Changes
 
+# Insert tab (Spec 04 M4)
+ribbon-tab-insert = Insert
+ribbon-group-media = Media
+ribbon-group-links = Links
+ribbon-insert-link-aria = Insert link
+ribbon-insert-link-title = Insert Link
+ribbon-insert-link-placeholder = https://example.com
+ribbon-insert-link-url-aria = Link URL
+ribbon-insert-link-apply = Apply
+ribbon-insert-link-cancel = Cancel
+ribbon-insert-link-remove = Remove
+ribbon-insert-image-aria = Insert image
+ribbon-insert-image-filter = Images
+ribbon-group-tables = Tables
+ribbon-group-references = References
+ribbon-insert-table-aria = Insert table
+ribbon-insert-footnote-aria = Insert footnote
+
 # Ribbon collapse toggle
 ribbon-collapse-aria = Collapse ribbon
 ribbon-expand-aria = Expand ribbon
diff --git a/loki-i18n/i18n/en-US/style.ftl b/loki-i18n/i18n/en-US/style.ftl
new file mode 100644
index 00000000..0f8e2c42
--- /dev/null
+++ b/loki-i18n/i18n/en-US/style.ftl
@@ -0,0 +1,53 @@
+# Style management panel (Spec 05)
+
+# Resolved-vs-overridden inspector (M2)
+style-inspector-heading = Where properties come from
+style-inspector-unset = —
+
+# Property labels
+style-prop-font-family = Font
+style-prop-font-size = Size
+style-prop-bold = Bold
+style-prop-italic = Italic
+style-prop-alignment = Alignment
+style-prop-indent-start = Indent (start)
+style-prop-indent-end = Indent (end)
+style-prop-indent-first-line = First-line indent
+style-prop-space-before = Space before
+style-prop-space-after = Space after
+style-prop-line-height = Line height
+
+# Reset-to-inherited control (shown on locally-set rows)
+style-reset-aria = Reset to inherited
+# Jump-to-ancestor link (shown on inherited rows)
+style-jump-aria = Open the source style
+# Pending (uncommitted draft edit) marker
+style-staged-title = Pending — apply to commit
+# Impact preview: dependent styles a staged change will also change
+style-impact-preview = Applying also changes { $count } dependent style(s): { $names }
+# Linked character style section heading (§9 linked family)
+style-linked-heading = Linked character style · { $name }
+# Character-styles family list heading (§9 character family)
+style-char-family-heading = Character styles
+# List-styles family list heading (§9 list family, non-inheriting)
+style-list-family-heading = List styles
+# One indent level of a list style
+style-list-level-label = Level { $n }
+# A list level's label kind and geometry (non-inheriting; shown read-only)
+style-list-level-detail = { $label } · indent { $indent } · hanging { $hanging } · { $alignment }
+# Compact (< 600 px) segmented switcher between the edit and inspect panes (§11)
+style-section-edit = Edit
+style-section-inspect = Inspect
+# Re-parenting rejected because it would create an inheritance cycle
+style-reparent-cycle = Cannot set that parent: it would create an inheritance cycle
+# Delete control (user styles only; built-in styles are protected)
+style-delete-label = Delete
+style-delete-aria = Delete this style
+style-delete-success = Style deleted; { $count } child style(s) re-parented
+style-delete-builtin = Built-in styles can't be deleted
+
+# Provenance labels
+style-provenance-local = Local
+style-provenance-inherited = Inherited · { $ancestor }
+style-provenance-default = Default
+style-provenance-engine = Auto
diff --git a/loki-i18n/src/loader.rs b/loki-i18n/src/loader.rs
index 52479ded..aaaa178a 100644
--- a/loki-i18n/src/loader.rs
+++ b/loki-i18n/src/loader.rs
@@ -14,11 +14,14 @@ use crate::embed::LokiTranslations;
 
 /// All translation domains; each maps to one `.ftl` file per locale.
 const DOMAINS: &[&str] = &[
-    "shell", "home", "editor", "ribbon", "errors", "document", "publish",
+    "shell", "home", "editor", "ribbon", "errors", "document", "publish", "style",
 ];
 
-/// Locale used when the system locale has no embedded translations.
-const FALLBACK_LOCALE: &str = "en-US";
+/// Locale used when the system locale has no embedded translations,
+/// constructed at compile time (no runtime parse can fail).
+fn fallback_locale() -> LanguageIdentifier {
+    unic_langid::langid!("en-US")
+}
 
 /// Type alias for the concurrent Fluent bundle.
 type Bundle = FluentBundle<FluentResource>;
@@ -39,9 +42,7 @@ impl LokiBundle {
     /// A separate `en-US` fallback bundle is kept so keys missing from the
     /// primary locale still resolve.
     pub fn load(locale_str: &str) -> Self {
-        let langid: LanguageIdentifier = locale_str
-            .parse()
-            .unwrap_or_else(|_| FALLBACK_LOCALE.parse().expect("en-US is valid"));
+        let langid: LanguageIdentifier = locale_str.parse().unwrap_or_else(|_| fallback_locale());
 
         let bundle = load_locale(&langid);
 
@@ -50,7 +51,7 @@ impl LokiBundle {
         // than a `starts_with("en-US")` string check) is important: variants
         // like `en-US-posix` have no embedded `.ftl` files of their own, so
         // without a fallback every key would render as its raw identifier.
-        let fb_id: LanguageIdentifier = FALLBACK_LOCALE.parse().expect("en-US is valid");
+        let fb_id: LanguageIdentifier = fallback_locale();
         let fallback = if langid == fb_id {
             None
         } else {
diff --git a/loki-layout/src/flow.rs b/loki-layout/src/flow.rs
index c3c1bdd1..48f223b5 100644
--- a/loki-layout/src/flow.rs
+++ b/loki-layout/src/flow.rs
@@ -15,6 +15,8 @@
 mod columns_impl;
 #[path = "flow_comments.rs"]
 mod comments_impl;
+#[path = "flow_editing.rs"]
+mod editing;
 #[path = "flow_float.rs"]
 mod float_impl;
 #[path = "flow_para.rs"]
@@ -128,15 +130,12 @@ pub(super) struct FlowState<'a> {
     pub(super) options: &'a LayoutOptions,
     /// Current y within the current page content area (or canvas).
     pub(super) cursor_y: f32,
-    /// Available width for content.
     pub(super) content_width: f32,
     /// Items accumulating in the current page (or entire canvas for continuous).
     pub(super) current_items: Vec<PositionedItem>,
     /// Completed pages (paginated mode only).
     pub(super) pages: Vec<LayoutPage>,
-    /// Physical page dimensions in points.
     pub(super) page_size: LayoutSize,
-    /// Content-area margins derived from the section's `PageLayout`.
     pub(super) margins: LayoutInsets,
     /// Height of the content area within a page (page_height − v_margins).
     pub(super) page_content_height: f32,
@@ -146,28 +145,22 @@ pub(super) struct FlowState<'a> {
     pub(super) warnings: Vec<LayoutWarning>,
     /// Accumulated horizontal indentation in points.
     pub(super) current_indent: f32,
-    /// Per-list counter arrays. Each entry maps a `ListId` to a 9-element
-    /// array where index = level (0-based) and value = current counter (1-based
-    /// after first advance, 0 = not yet initialised).
+    /// Per-list counters: `ListId` → 9-element array (index = level, value =
+    /// current counter; `0` = not yet initialised).
     pub(super) list_counters: HashMap<ListId, [u32; 9]>,
-    /// The `ListId` of the most recently placed list item, used to detect
-    /// list-id changes and reset counters for the new list.
+    /// `ListId` of the most recently placed list item (to detect list changes).
     pub(super) prev_list_id: Option<ListId>,
-    /// Monotonically-increasing counter for footnotes and endnotes within
-    /// the current section. Incremented by `walk_inlines` when a `Note` is met.
+    /// Footnote/endnote counter for the current section (bumped by `walk_inlines`).
     pub(super) note_counter: u32,
-    /// Footnotes and endnotes collected while flowing the current section.
-    /// Rendered at the end of the section by `flow_footnotes`.
+    /// Footnotes/endnotes collected this section, rendered by `flow_footnotes`.
     pub(super) pending_footnotes: Vec<CollectedNote>,
     /// Paragraph metadata for the current page (block index, layout, origin).
     pub(super) current_paragraphs: Vec<PageParagraphData>,
-    /// Clean-page-top checkpoints recorded during a top-level paginated flow,
-    /// used by incremental relayout. Populated only by [`run_paginated_loop`];
-    /// nested flows (tables, cells, headers) never call it, so it stays empty.
+    /// Clean-page-top checkpoints for incremental relayout; populated only by the
+    /// top-level paginated loop (empty in nested flows).
     pub(super) checkpoints: Vec<PageStart>,
-    /// Number of text columns for this section (`1` = single column). When
-    /// `> 1`, [`content_width`](Self::content_width) holds the *column* width and
-    /// content flows down each column before moving to the next, then the page.
+    /// Number of text columns (`1` = single); when `> 1`,
+    /// [`content_width`](Self::content_width) is the *column* width.
     pub(super) columns: u8,
     /// Gap between adjacent columns in points (meaningful only when `columns > 1`).
     pub(super) column_gap: f32,
@@ -175,33 +168,29 @@ pub(super) struct FlowState<'a> {
     pub(super) column_separator: bool,
     /// 0-based index of the column currently being filled.
     pub(super) col_index: u8,
-    /// Content-area y at which the current column band begins. Normally `0`
-    /// (columns start at the page content top), but a `continuous` section break
-    /// can start a new column band *mid-page* (below the previous section), so
-    /// each column of that band starts here rather than at `0`.
+    /// Content-area y where the current column band begins (`0` normally; mid-page
+    /// for a `continuous` section break that starts a band below the previous one).
     pub(super) column_top_y: f32,
-    /// Index into `current_items` at which the current column's items begin, so
-    /// they can be shifted to the column's horizontal offset when it is finished.
+    /// First `current_items` index of the current column (shifted to its x offset
+    /// when the column finishes).
     pub(super) column_item_start: usize,
-    /// Index into `current_paragraphs` at which the current column's editing
-    /// data begins (parallel to `column_item_start`).
+    /// First `current_paragraphs` index of the current column (parallel to
+    /// `column_item_start`).
     pub(super) column_para_start: usize,
-    /// Document comments (annotation bodies), looked up by id when laying out
-    /// the comment panel. Empty in nested flows (headers/footers, cells).
+    /// Document comments, looked up by id for the gutter panel; empty in nested flows.
     pub(super) comments: &'a [loki_doc_model::content::annotation::Comment],
-    /// Comment anchors (`id`, content-local `y`) recorded on the current page,
-    /// consumed by [`finish_page`] to lay out the gutter comment panel.
+    /// Comment anchors (`id`, content-local `y`) on the current page, consumed by
+    /// [`finish_page`] for the gutter comment panel.
     pub(super) pending_comment_anchors: Vec<(String, f32)>,
-    /// When `true`, paragraphs laid out in this state break over-long words to
-    /// the available width (CSS `overflow-wrap: anywhere`). Set while flowing
-    /// table-cell content so a long word wraps to the column width instead of
-    /// overflowing into the neighbouring cell.
+    /// Break over-long words to the available width (CSS `overflow-wrap: anywhere`);
+    /// set while flowing table-cell content so words wrap to the column width.
     pub(super) break_long_words: bool,
-    /// A float taller than its anchoring paragraph whose remaining vertical
-    /// extent the following paragraphs on this page keep wrapping beside. Set by
-    /// [`para_impl::flow_paragraph`]; reserved/cleared by
-    /// [`float_impl::reserve_active_float`] and on every page boundary.
+    /// A float taller than its anchoring paragraph whose remaining extent the
+    /// following paragraphs keep wrapping beside. Set by `para_impl::flow_paragraph`;
+    /// cleared by `float_impl::reserve_active_float` and on every page boundary.
     pub(super) active_float: Option<float_impl::ActiveFloat>,
+    /// Editing-path context for nested content (see [`editing::NestedEditing`]).
+    pub(super) nested_editing: Option<editing::NestedEditing>,
 }
 
 impl FlowState<'_> {
@@ -220,9 +209,8 @@ impl FlowState<'_> {
 impl<'a> FlowState<'a> {
     /// Advance the counter for `list_id` at `level` and return the new value.
     ///
-    /// - Initialises the counter from `start_value` on first use.
-    /// - Resets all deeper-level counters to 0 so they re-initialise from
-    ///   their own `start_value` when next encountered.
+    /// Initialises from `start_value` on first use; resets all deeper-level
+    /// counters to 0 so they re-initialise from their own `start_value` next.
     pub(super) fn advance_counter(&mut self, list_id: &ListId, level: u8, start_value: u32) -> u32 {
         let counters = self
             .list_counters
@@ -324,6 +312,7 @@ fn new_flow_state<'a>(
         pending_comment_anchors: Vec::new(),
         break_long_words: false,
         active_float: None,
+        nested_editing: None,
     }
 }
 
@@ -382,11 +371,10 @@ fn run_paginated_loop(
 /// Resumes a paginated body flow at `start_block` from a [`FlowCheckpoint`],
 /// for incremental relayout. See [`crate::incremental`].
 ///
-/// Returns the pages produced from `start_block` up to either the end of the
-/// section or the first clean page top where `resync` fires. When it runs to the
-/// end, the trailing footnotes and final partial page are flushed; when it stops
-/// at a resync the current page is empty (a clean page top) and is not flushed,
-/// so the caller can splice the reused suffix without a duplicate page.
+/// Returns the pages produced from `start_block` up to the end of the section or
+/// the first clean page top where `resync` fires. Running to the end flushes the
+/// trailing footnotes and final partial page; stopping at a resync leaves the
+/// empty current page unflushed, so the caller splices the reused suffix cleanly.
 #[allow(clippy::too_many_arguments)]
 pub(crate) fn flow_section_resume(
     resources: &mut FontResources,
@@ -439,9 +427,8 @@ pub(crate) fn flow_section_resume(
 /// Returns a [`FlowOutput`] discriminated by layout mode:
 ///
 /// - [`FlowOutput::Pages`]: each page's items are in page-content-area-local
-///   coordinates (origin `(0, 0)` at the content-area top-left). The `margins`
-///   field on each [`LayoutPage`] carries the insets. No further translation
-///   by the caller is needed.
+///   coordinates (origin `(0, 0)` at the content-area top-left); the `margins`
+///   on each [`LayoutPage`] carry the insets. No caller translation needed.
 /// - [`FlowOutput::Canvas`]: all items on a single canvas. In `Pageless` mode
 ///   items are offset by `margins.left`; in `Reflow` mode there is no offset.
 pub fn flow_section(
@@ -545,8 +532,7 @@ fn begin_continuous_section(state: &mut FlowState, section: &Section) {
 ///
 /// Paginated mode only — the non-paginated (reflow/pageless) path flows each
 /// section independently (continuous-scroll has no pages to share). Editing
-/// block indices are group-local (0-based across the group's combined blocks);
-/// the caller globalises them like a single section.
+/// block indices are group-local; the caller globalises them per section.
 pub fn flow_section_group(
     resources: &mut FontResources,
     sections: &[&Section],
@@ -954,9 +940,8 @@ fn substitute_page_fields(blocks: &mut [Block], ctx: &crate::FieldContext) {
 /// per page with a [`crate::FieldContext`] carrying the real page number and
 /// `total_page_count`, so "Page X of Y" chrome renders correctly.
 ///
-/// Items are translated to page-local coordinates:
-/// - Header top: `margins.header`
-/// - Footer top: `page_height - margins.footer - footer_height`
+/// Items are translated to page-local coords: header top `margins.header`;
+/// footer top `page_height - margins.footer - footer_height`.
 pub(crate) fn assign_headers_footers(
     pages: &mut [LayoutPage],
     layout: &PageLayout,
@@ -1145,7 +1130,14 @@ fn flow_footnotes(state: &mut FlowState) {
     for note in notes {
         let mark = format!("{} ", &footnote_mark(note.number));
         let mut first = true;
-        for block in &note.blocks {
+        for (body_block, block) in note.blocks.iter().enumerate() {
+            // Tag body paragraph(s) so a click into the footnote resolves to the
+            // live note-body container.
+            state.nested_editing = Some(editing::NestedEditing::note(
+                note.owner_block_index,
+                note.note_in_block,
+                body_block,
+            ));
             if first {
                 first = false;
                 if let Block::StyledPara(p) = block {
@@ -1158,6 +1150,7 @@ fn flow_footnotes(state: &mut FlowState) {
             flow_block(state, block, 0);
         }
     }
+    state.nested_editing = None;
 }
 
 /// Return the Unicode superscript mark for note number `n`.
@@ -1339,6 +1332,7 @@ fn measure_cell_height(
         // Cell content: break over-long words to the column width (Word).
         break_long_words: true,
         active_float: None,
+        nested_editing: None,
     };
 
     for block in &cell.blocks {
@@ -1479,6 +1473,7 @@ fn flow_cell_blocks(
         // Cell content: break over-long words to the column width (Word).
         break_long_words: true,
         active_float: None,
+        nested_editing: None,
     };
 
     for block in blocks {
@@ -1606,7 +1601,9 @@ fn flow_table(
         }
     }
 
-    // Pass 3: Place and flow cell blocks
+    // Pass 3: Place and flow cell blocks. `cell_flat` counts cells in the bridge's
+    // flat `KEY_TABLE_CELLS` order so cell paragraphs get a matching `PathStep::Cell`.
+    let mut cell_flat = 0usize;
     for (row_idx, row) in rows.iter().enumerate() {
         let row_max_h = row_heights[row_idx];
 
@@ -1674,11 +1671,10 @@ fn flow_table(
             };
 
             let cell_items = if let Some(degrees) = rotation_degrees {
-                // NOTE(cell-rotation): for rotated cells, content is laid out
-                // with width/height swapped, then the RotatedGroup transform
-                // visually rotates the result into the correct orientation.
-                // This approximation works for text runs but may not be pixel-
-                // perfect for complex mixed content.
+                // NOTE(cell-rotation): content laid out width/height-swapped,
+                // then RotatedGroup rotates it (fine for text runs).
+                // TODO(rotated-cell-editing): emits no editing data (the caret
+                // needs the same rotation transform) — cells stay read-only.
                 let rotated_content_width = (cell_height - pad_top - pad_bottom).max(0.0);
                 let inner_items = flow_cell_blocks(
                     state.resources,
@@ -1719,9 +1715,13 @@ fn flow_table(
                 let old_break = state.break_long_words;
                 state.break_long_words = true;
 
-                for block in &cell.blocks {
+                let cell_para_start = state.current_paragraphs.len();
+                for (bi, block) in cell.blocks.iter().enumerate() {
+                    // Tag cell paragraphs so a click resolves to the live cell.
+                    state.nested_editing = Some(editing::NestedEditing::cell(idx, cell_flat, bi));
                     flow_block(state, block, idx);
                 }
+                state.nested_editing = None;
                 state.break_long_words = old_break;
 
                 // If it fits on a single page, apply vertical alignment
@@ -1740,17 +1740,16 @@ fn flow_table(
                         for item in &mut state.current_items[cell_item_start..] {
                             item.translate(0.0, y_offset);
                         }
+                        // Editing origins must follow their translated glyphs so
+                        // the caret in a v-aligned cell lands on the text.
+                        for para in &mut state.current_paragraphs[cell_para_start..] {
+                            para.origin.1 += y_offset;
+                        }
                     }
 
-                    // Clip the cell's content to its box so over-wide content
-                    // (a wide image, or an unbreakable token exceeding the
-                    // column) cannot bleed into neighbouring cells — Word clips
-                    // cell content to the cell boundary. Char-wrapping already
-                    // keeps ordinary text inside the column; this is the safety
-                    // net for the rest. Only single-page cells are clipped here;
-                    // a cell that spilled onto a later page keeps its items
-                    // unwrapped (per-page clipping would need a rect per page —
-                    // see fidelity-status Tables & Images).
+                    // Clip single-page cell content to its box so over-wide
+                    // content can't bleed into neighbours (Word). A cell spilling
+                    // to a later page stays unclipped — see fidelity-status.
                     if state.current_items.len() > cell_item_start {
                         let cell_top_y = if state.page_number == original_row_page {
                             original_row_y_start
@@ -1785,6 +1784,7 @@ fn flow_table(
 
             state.current_indent = old_indent;
             state.content_width = old_width;
+            cell_flat += 1;
         }
 
         let row_page_end = state.page_number;
diff --git a/loki-layout/src/flow_editing.rs b/loki-layout/src/flow_editing.rs
new file mode 100644
index 00000000..81baa57b
--- /dev/null
+++ b/loki-layout/src/flow_editing.rs
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Editing-data emission for the flow engine.
+//!
+//! [`push_editing_para`] records one [`PageParagraphData`] per laid-out
+//! paragraph (consumed by hit-testing / cursor positioning when
+//! `preserve_for_editing` is on). [`NestedEditing`] is the path context for
+//! content flowed *inside* a container (currently a footnote/endnote body): while
+//! set on the [`FlowState`], emitted paragraphs are addressed by the container's
+//! root block + a `PathStep` descent instead of their flat block index, so the
+//! editor can reach them via a `loki_doc_model::BlockPath`.
+
+use std::sync::Arc;
+
+use loki_doc_model::PathStep;
+
+use super::FlowState;
+use crate::para::ParagraphLayout;
+use crate::result::PageParagraphData;
+
+/// Editing-path context for nested content (see the module docs).
+pub(crate) struct NestedEditing {
+    pub(super) root_block: usize,
+    pub(super) path: Vec<PathStep>,
+}
+
+impl NestedEditing {
+    /// Context for the `body_block`-th block of `owner`'s `note_idx`-th note.
+    pub(super) fn note(owner: usize, note_idx: usize, body_block: usize) -> Self {
+        Self {
+            root_block: owner,
+            path: vec![PathStep::Note {
+                note: note_idx,
+                block: body_block,
+            }],
+        }
+    }
+
+    /// Context for the `body_block`-th block of the `cell`-th cell (in the
+    /// bridge's flat head → bodies → foot order) of the table at `table`.
+    pub(super) fn cell(table: usize, cell: usize, body_block: usize) -> Self {
+        Self {
+            root_block: table,
+            path: vec![PathStep::Cell {
+                cell,
+                block: body_block,
+            }],
+        }
+    }
+}
+
+/// Records a paragraph's editing data. When `state.nested_editing` is set (a
+/// footnote body) the paragraph is tagged with that container's root block +
+/// path; otherwise it is top-level (`path` empty).
+pub(super) fn push_editing_para(
+    state: &mut FlowState,
+    block_index: usize,
+    layout: Arc<ParagraphLayout>,
+    origin: (f32, f32),
+) {
+    let (block_index, path) = match &state.nested_editing {
+        Some(ctx) => (ctx.root_block, ctx.path.clone()),
+        None => (block_index, Vec::new()),
+    };
+    state.current_paragraphs.push(PageParagraphData {
+        block_index,
+        path,
+        layout,
+        origin,
+    });
+}
diff --git a/loki-layout/src/flow_para.rs b/loki-layout/src/flow_para.rs
index 2122a2c8..caf01c50 100644
--- a/loki-layout/src/flow_para.rs
+++ b/loki-layout/src/flow_para.rs
@@ -59,9 +59,9 @@ use crate::para::{
     ParagraphLayout, ResolvedParaProps, format_list_marker, layout_paragraph_spelled,
 };
 use crate::resolve::{emu_to_pt, flatten_paragraph, pts_to_f32, resolve_para_props};
-use crate::result::PageParagraphData;
 
 use super::columns_impl::break_column;
+use super::editing::push_editing_para;
 use super::{FlowState, LayoutWarning, finish_page};
 
 /// Maximum keep-with-next chain length before truncation (ADR 004 §4).
@@ -140,8 +140,13 @@ pub(super) fn flow_paragraph(state: &mut FlowState, para: &StyledParagraph, bloc
     let effective_para: &StyledParagraph = owned_para.as_ref().unwrap_or(para);
     // ────────────────────────────────────────────────────────────────────────
 
-    let (text, spans, mut images, notes) =
+    let (text, spans, mut images, mut notes) =
         flatten_paragraph(effective_para, state.catalog, &mut state.note_counter);
+    // Tag each note with its owning block + per-block order (see flow_footnotes).
+    for (i, note) in notes.iter_mut().enumerate() {
+        note.owner_block_index = block_index;
+        note.note_in_block = i;
+    }
     state.pending_footnotes.extend(notes);
 
     // ── Floating image wrap (gap #12) ────────────────────────────────────────
@@ -295,13 +300,8 @@ pub(super) fn place_paragraph_layout(
         let dy = state.cursor_y;
         let dx = state.current_indent;
         if state.options.preserve_for_editing {
-            state.current_paragraphs.push(PageParagraphData {
-                block_index,
-                layout: Arc::new(para_layout.clone()),
-                // Match the item translation below so hit-testing and cursor
-                // geometry line up with the rendered glyphs (lists indent dx).
-                origin: (dx, dy),
-            });
+            // origin (dx, dy) matches the item translation below (lists indent dx).
+            push_editing_para(state, block_index, Arc::new(para_layout.clone()), (dx, dy));
         }
         for mut item in para_layout.items {
             item.translate(dx, dy);
@@ -336,11 +336,7 @@ pub(super) fn place_paragraph_layout(
             let dy = state.cursor_y;
             let dx = state.current_indent;
             if state.options.preserve_for_editing {
-                state.current_paragraphs.push(PageParagraphData {
-                    block_index,
-                    layout: Arc::new(para_layout.clone()),
-                    origin: (0.0, dy),
-                });
+                push_editing_para(state, block_index, Arc::new(para_layout.clone()), (0.0, dy));
             }
             for mut item in para_layout.items {
                 item.translate(dx, dy);
@@ -603,11 +599,7 @@ fn split_and_place_loop(
             if frag_start < f32::EPSILON {
                 // First (and only) fragment: emit items directly without clip.
                 if let Some(ref al) = arc_layout {
-                    state.current_paragraphs.push(PageParagraphData {
-                        block_index,
-                        layout: al.clone(),
-                        origin: (0.0, ty),
-                    });
+                    push_editing_para(state, block_index, al.clone(), (0.0, ty));
                 }
                 for item in &para_layout.items {
                     let mut item = item.clone();
@@ -617,11 +609,7 @@ fn split_and_place_loop(
             } else {
                 // Continuation fragment: clip to hide content from prior pages.
                 if let Some(ref al) = arc_layout {
-                    state.current_paragraphs.push(PageParagraphData {
-                        block_index,
-                        layout: al.clone(),
-                        origin: (0.0, ty),
-                    });
+                    push_editing_para(state, block_index, al.clone(), (0.0, ty));
                 }
                 let clip_rect =
                     LayoutRect::new(0.0, state.cursor_y, state.content_width, frag_height);
@@ -671,11 +659,7 @@ fn split_and_place_loop(
                     // Still no progress: emit remainder and bail.
                     let ty = state.cursor_y - frag_start;
                     if let Some(ref al) = arc_layout {
-                        state.current_paragraphs.push(PageParagraphData {
-                            block_index,
-                            layout: al.clone(),
-                            origin: (0.0, ty),
-                        });
+                        push_editing_para(state, block_index, al.clone(), (0.0, ty));
                     }
                     for item in &para_layout.items {
                         let mut item = item.clone();
@@ -744,11 +728,7 @@ fn emit_fragment(
     let clip_rect = LayoutRect::new(0.0, state.cursor_y, state.content_width, clip_height);
     let ty = state.cursor_y - frag_start;
     if let Some(al) = arc_layout {
-        state.current_paragraphs.push(PageParagraphData {
-            block_index,
-            layout: al,
-            origin: (0.0, ty),
-        });
+        push_editing_para(state, block_index, al, (0.0, ty));
     }
     let mut items = para_layout.items.clone();
     for item in &mut items {
diff --git a/loki-layout/src/lib.rs b/loki-layout/src/lib.rs
index dd360394..fd5d38bc 100644
--- a/loki-layout/src/lib.rs
+++ b/loki-layout/src/lib.rs
@@ -235,13 +235,11 @@ pub fn layout_paginated_full(
     // its page geometry + headers/footers), only switching column layout.
     let mut groups: Vec<Vec<&loki_doc_model::Section>> = Vec::new();
     for section in &doc.sections {
-        if groups.is_empty() || section.start != loki_doc_model::layout::SectionStart::Continuous {
-            groups.push(vec![section]);
-        } else {
-            groups
-                .last_mut()
-                .expect("groups is non-empty here")
-                .push(section);
+        match groups.last_mut() {
+            Some(last) if section.start == loki_doc_model::layout::SectionStart::Continuous => {
+                last.push(section);
+            }
+            _ => groups.push(vec![section]),
         }
     }
 
diff --git a/loki-layout/src/para.rs b/loki-layout/src/para.rs
index 84cfde0a..b03dd0fe 100644
--- a/loki-layout/src/para.rs
+++ b/loki-layout/src/para.rs
@@ -172,10 +172,10 @@ pub struct StyleSpan {
     pub strikethrough: Option<StrikethroughStyle>,
     /// Line-height multiplier (e.g. `1.5`). `None` = paragraph default.
     pub line_height: Option<f32>,
-    /// Vertical alignment for super/subscript. Font size is reduced to 58%.
-    ///
-    /// TODO(super-sub): Parley does not expose baseline-shift; only font-size
-    /// reduction applied. Revisit when Parley adds StyleProperty::BaselineShift.
+    /// Vertical alignment for super/subscript. Font size is reduced to 58% and
+    /// the run is shifted via a manual `va_offset` in `para_emit` (plus a
+    /// per-glyph `baseline_shift` for `w:position`). TODO(super-sub): the shift is
+    /// manual only because Parley lacks a native `StyleProperty::BaselineShift`.
     pub vertical_align: Option<VerticalAlign>,
     /// Highlight colour to paint behind the run. `None` = no highlight.
     pub highlight_color: Option<LayoutColor>,
@@ -866,8 +866,8 @@ pub(crate) fn push_para_styles(
             continue;
         }
         let r = span.range.clone();
-        // For super/subscript (gap #3), reduce font size to 58 %.
-        // TODO(super-sub): Parley does not expose baseline-shift.
+        // For super/subscript (gap #3), reduce font size to 58 %. The shift is
+        // applied in `para_emit` (`va_offset`) — TODO(super-sub): no native API.
         let effective_font_size = if span.vertical_align.is_some() {
             span.font_size * 0.58
         } else {
@@ -1452,12 +1452,9 @@ fn layout_paragraph_uncached(
 
     // Precise per-line band split runs on the read-only paint path for plain
     // text; the editor / tab / math paths fall back to a uniform narrow below.
-    let can_split = band.is_some()
-        && !preserve_for_editing
-        && tab_char_positions.is_empty()
-        && math_boxes.is_empty();
+    let can_split = !preserve_for_editing && tab_char_positions.is_empty() && math_boxes.is_empty();
 
-    if can_split {
+    if let Some(band) = band.as_ref().filter(|_| can_split) {
         let body = crate::para_band::layout_band_body(
             resources,
             &clean_text,
@@ -1465,7 +1462,7 @@ fn layout_paragraph_uncached(
             para_props,
             line_w,
             display_scale,
-            band.expect("can_split implies band"),
+            band,
         );
         let mut items = body.items;
         let mut content_bottom = body.height;
diff --git a/loki-layout/src/para_band.rs b/loki-layout/src/para_band.rs
index ca8c0ca2..811625c2 100644
--- a/loki-layout/src/para_band.rs
+++ b/loki-layout/src/para_band.rs
@@ -57,7 +57,7 @@ pub(crate) fn layout_band_body(
     para_props: &ResolvedParaProps,
     line_w: f32,
     display_scale: f32,
-    band: Band,
+    band: &Band,
 ) -> BandBody {
     let indent_start = para_props.indent_start;
     let x_shift = if band.shift_text { band.inset } else { 0.0 };
diff --git a/loki-layout/src/para_band_tests.rs b/loki-layout/src/para_band_tests.rs
index 11d0a0bc..63477e43 100644
--- a/loki-layout/src/para_band_tests.rs
+++ b/loki-layout/src/para_band_tests.rs
@@ -69,7 +69,7 @@ fn left_band_shifts_first_lines_and_tail_reclaims_full_width() {
         cover_height: 30.0,
         shift_text: true,
     };
-    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, band);
+    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, &band);
 
     let origins = run_origins(&body);
     assert!(origins.len() >= 4, "expected several wrapped lines");
@@ -112,7 +112,7 @@ fn right_band_narrows_without_shifting() {
         cover_height: 30.0,
         shift_text: false,
     };
-    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, band);
+    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, &band);
     let origins = run_origins(&body);
     // All lines start at the left edge (x ≈ 0) regardless of the band.
     for (_, x) in &origins {
@@ -131,7 +131,7 @@ fn short_body_within_band_stays_single_segment() {
         cover_height: 200.0, // taller than the single line
         shift_text: true,
     };
-    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, band);
+    let body = layout_band_body(&mut r, text, &spans, &props, 360.0, 1.0, &band);
     let origins = run_origins(&body);
     assert!(!origins.is_empty());
     // The single line is in the band → shifted right by the inset.
diff --git a/loki-layout/src/resolve.rs b/loki-layout/src/resolve.rs
index 0bc81d61..5e838ddc 100644
--- a/loki-layout/src/resolve.rs
+++ b/loki-layout/src/resolve.rs
@@ -10,31 +10,13 @@
 //!
 //! # Session 4 pre-audit findings (2026-04-20)
 //!
-//! ## Q1 — Inline::Image data resolution
+//! ## Q1 — Inline::Image data resolution (implemented)
 //!
-//! `Inline::Image` is defined as `Image(NodeAttr, Vec<Inline>, LinkTarget)`
-//! where `LinkTarget.url` carries either:
-//! - A **data URI** (`"data:image/png;base64,…"`) when
-//!   `DocxImportOptions::embed_images == true` (the default). The OOXML mapper
-//!   (`loki-ooxml/src/docx/mapper/images.rs:38–44`) resolves the `a:blip
-//!   r:embed` relationship ID against the OPC package, base64-encodes the raw
-//!   bytes, and stores the data URI in `LinkTarget.url`.
-//! - An **unresolved relationship ID** (e.g. `"rId1"`) when
-//!   `embed_images == false`.
-//!   Width and height in EMUs are stored in `NodeAttr.kv` as `("cx_emu", val)`
-//!   and `("cy_emu", val)`. Alt text is the `Vec<Inline>` second field.
-//!   `loki-vello` (`loki-vello/src/image.rs:34`) only renders data URIs; external
-//!   URLs produce a grey placeholder rectangle. **With `embed_images` on (the
-//!   default), image data is available at layout time — Session 4 is a one-session
-//!   wire-up.**
-//!
-//! `walk_inlines` currently treats `Inline::Image` like `Inline::Link` — it
-//! recurses into the alt-text child inlines and silently discards the `src` and
-//! dimensions (`resolve.rs:351`). The fix is to extract `LinkTarget.url`,
-//! `cx_emu`/`cy_emu`, and emit a `PositionedImage` into the paragraph's item
-//! list. `PositionedItem::Image(PositionedImage)` already exists in
-//! `loki-layout/src/items.rs:30` with fields `rect: LayoutRect`, `src: String`,
-//! `alt: Option<String>`.
+//! `Image(NodeAttr, Vec<Inline>, LinkTarget)` carries the src in `LinkTarget.url`
+//! (a `data:` URI when `embed_images`, else an unresolved rel ID) and
+//! `cx_emu`/`cy_emu` in `NodeAttr.kv`; alt text is the `Vec<Inline>`. `loki-vello`
+//! renders only data URIs (external URLs → grey placeholder). `walk_inlines`
+//! emits a `CollectedImage`, placed post-Parley as a `PositionedImage`.
 //!
 //! ## Q2 — Inline::Link current behaviour
 //!
@@ -164,6 +146,11 @@ pub struct CollectedNote {
     pub kind: NoteKind,
     /// The note body blocks.
     pub blocks: Vec<Block>,
+    /// Owning paragraph's global block index; set by `flow_paragraph` (0 until then).
+    pub owner_block_index: usize,
+    /// This note's index among its block's notes (the bridge `KEY_NOTES` index),
+    /// so the editor can address the body via a `PathStep::Note`.
+    pub note_in_block: usize,
 }
 
 /// Resolve the effective [`ResolvedParaProps`] for a [`StyledParagraph`].
@@ -794,6 +781,9 @@ fn walk_inlines(
                     number: *note_counter,
                     kind: *kind,
                     blocks: blocks.clone(),
+                    // Set by `flow_paragraph` after collection.
+                    owner_block_index: 0,
+                    note_in_block: 0,
                 });
             }
             // Math (gap): record an empty-range placeholder span carrying the
diff --git a/loki-layout/src/result.rs b/loki-layout/src/result.rs
index c05aa3a3..7fce169f 100644
--- a/loki-layout/src/result.rs
+++ b/loki-layout/src/result.rs
@@ -26,8 +26,14 @@ pub struct PageEditingData {
 /// Metadata for a single paragraph fragment on a page.
 #[derive(Debug, Clone)]
 pub struct PageParagraphData {
-    /// Global index of the paragraph block in the document.
+    /// Global index of the paragraph block in the document — the **root** block
+    /// for nested paragraphs (the table or note-bearing block).
     pub block_index: usize,
+    /// Descent from `block_index` into a nested container (a table cell or note
+    /// body). Empty for ordinary top-level paragraphs. Together with
+    /// `block_index` this forms the `loki_doc_model::BlockPath` the editor uses
+    /// to address the paragraph for mutation.
+    pub path: Vec<loki_doc_model::PathStep>,
     /// The preserved layout data for hit-testing and cursor positioning.
     pub layout: Arc<ParagraphLayout>,
     /// Page-local `(x, y)` origin of the paragraph in points, relative to
diff --git a/loki-layout/src/result_tests.rs b/loki-layout/src/result_tests.rs
index e8270e40..7f0982c6 100644
--- a/loki-layout/src/result_tests.rs
+++ b/loki-layout/src/result_tests.rs
@@ -62,6 +62,7 @@ fn para(text: &str, block_index: usize, origin: (f32, f32)) -> PageParagraphData
     );
     PageParagraphData {
         block_index,
+        path: Vec::new(),
         layout: Arc::new(layout),
         origin,
     }
diff --git a/loki-layout/tests/footnote_editing_tests.rs b/loki-layout/tests/footnote_editing_tests.rs
new file mode 100644
index 00000000..94e87ddf
--- /dev/null
+++ b/loki-layout/tests/footnote_editing_tests.rs
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Footnote-body paragraphs must emit *editing data* addressing the live note
+//! body: `block_index` = the owning paragraph's block (not the old `0`), and a
+//! `PathStep::Note` descent. This is the layout half of editable footnotes
+//! (Spec 04 M4, nested-editing increment 3).
+
+use loki_doc_model::PathStep;
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::{Block, StyledParagraph};
+use loki_doc_model::content::inline::{Inline, NoteKind};
+use loki_doc_model::document::Document;
+use loki_layout::{
+    DocumentLayout, FontResources, LayoutMode, LayoutOptions, PaginatedLayout, layout_document,
+};
+
+fn resources() -> FontResources {
+    let mut r = FontResources::new();
+    for p in [
+        "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
+        "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
+    ] {
+        if let Ok(data) = std::fs::read(p) {
+            r.register_font(data);
+            break;
+        }
+    }
+    r
+}
+
+fn styled(inlines: Vec<Inline>) -> Block {
+    Block::StyledPara(StyledParagraph {
+        style_id: None,
+        direct_para_props: None,
+        direct_char_props: None,
+        inlines,
+        attr: NodeAttr::default(),
+    })
+}
+
+#[test]
+fn footnote_body_paragraph_carries_note_editing_path() {
+    // Block 0: "see" + a footnote whose body is "the note body".
+    let note = Inline::Note(
+        NoteKind::Footnote,
+        vec![styled(vec![Inline::Str("the note body".into())])],
+    );
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![styled(vec![Inline::Str("see ".into()), note])];
+
+    let mut r = resources();
+    let DocumentLayout::Paginated(PaginatedLayout { pages, .. }) = layout_document(
+        &mut r,
+        &doc,
+        LayoutMode::Paginated,
+        1.0,
+        &LayoutOptions {
+            preserve_for_editing: true,
+            spell: None,
+        },
+    ) else {
+        panic!("paginated layout expected");
+    };
+
+    let paras: Vec<_> = pages
+        .iter()
+        .filter_map(|p| p.editing_data.as_ref())
+        .flat_map(|ed| ed.paragraphs.iter())
+        .collect();
+
+    // The main paragraph is top-level (block 0, empty path).
+    assert!(
+        paras
+            .iter()
+            .any(|p| p.block_index == 0 && p.path.is_empty()),
+        "the body paragraph should be present and top-level"
+    );
+
+    // The footnote body paragraph carries the note path, owned by block 0.
+    let note_para = paras
+        .iter()
+        .find(|p| !p.path.is_empty())
+        .expect("a footnote-body paragraph with a nested editing path");
+    assert_eq!(
+        note_para.block_index, 0,
+        "footnote body must be owned by its reference's block, not 0"
+    );
+    assert_eq!(
+        note_para.path,
+        vec![PathStep::Note { note: 0, block: 0 }],
+        "footnote body path must address note 0, body block 0"
+    );
+}
diff --git a/loki-layout/tests/table_cell_editing_tests.rs b/loki-layout/tests/table_cell_editing_tests.rs
new file mode 100644
index 00000000..ba5e314f
--- /dev/null
+++ b/loki-layout/tests/table_cell_editing_tests.rs
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Table-cell paragraphs must emit editing data addressing the live cell
+//! container: `block_index` = the table's block, and a `PathStep::Cell` whose
+//! index matches the bridge's flat `KEY_TABLE_CELLS` order (head → bodies →
+//! foot, row-major). Layout half of editable table cells (Spec 04 M4).
+
+use loki_doc_model::PathStep;
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::{Block, StyledParagraph};
+use loki_doc_model::content::inline::Inline;
+use loki_doc_model::content::table::core::{Table, TableBody, TableCaption, TableFoot, TableHead};
+use loki_doc_model::content::table::row::{Cell, CellVerticalAlign, Row};
+use loki_doc_model::document::Document;
+use loki_layout::{
+    DocumentLayout, FontResources, LayoutMode, LayoutOptions, PaginatedLayout, layout_document,
+};
+
+fn resources() -> FontResources {
+    let mut r = FontResources::new();
+    for p in [
+        "/usr/share/fonts/truetype/liberation/LiberationSans-Regular.ttf",
+        "/usr/share/fonts/truetype/dejavu/DejaVuSans.ttf",
+    ] {
+        if let Ok(data) = std::fs::read(p) {
+            r.register_font(data);
+            break;
+        }
+    }
+    r
+}
+
+fn text_cell(s: &str) -> Cell {
+    Cell::simple(vec![Block::StyledPara(StyledParagraph {
+        style_id: None,
+        direct_para_props: None,
+        direct_char_props: None,
+        inlines: vec![Inline::Str(s.into())],
+        attr: NodeAttr::default(),
+    })])
+}
+
+#[test]
+fn table_cell_paragraphs_carry_cell_editing_path() {
+    // One table (block 0): a single body row with two cells "a" | "b".
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![
+            text_cell("a"),
+            text_cell("b"),
+        ])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Table(Box::new(table))];
+
+    let mut r = resources();
+    let DocumentLayout::Paginated(PaginatedLayout { pages, .. }) = layout_document(
+        &mut r,
+        &doc,
+        LayoutMode::Paginated,
+        1.0,
+        &LayoutOptions {
+            preserve_for_editing: true,
+            spell: None,
+        },
+    ) else {
+        panic!("paginated layout expected");
+    };
+
+    let cell_paras: Vec<_> = pages
+        .iter()
+        .filter_map(|p| p.editing_data.as_ref())
+        .flat_map(|ed| ed.paragraphs.iter())
+        .filter(|p| !p.path.is_empty())
+        .collect();
+
+    assert_eq!(cell_paras.len(), 2, "two cell paragraphs: {cell_paras:?}");
+    for p in &cell_paras {
+        assert_eq!(p.block_index, 0, "cells owned by the table's block 0");
+    }
+    // Cell 0 then cell 1, in flat order, each body block 0.
+    assert_eq!(
+        cell_paras[0].path,
+        vec![PathStep::Cell { cell: 0, block: 0 }]
+    );
+    assert_eq!(
+        cell_paras[1].path,
+        vec![PathStep::Cell { cell: 1, block: 0 }]
+    );
+}
+
+/// `origin.y` of the first cell's (flat index 0) editing paragraph in a row
+/// whose first cell uses `align` and whose second cell is tall enough to leave
+/// vertical slack in the first.
+fn first_cell_origin_y(align: CellVerticalAlign) -> f32 {
+    let mut short = text_cell("a");
+    short.props.vertical_align = Some(align);
+    // A four-paragraph cell makes the row much taller than the short cell.
+    let tall = Cell::simple(
+        (0..4)
+            .map(|_| {
+                Block::StyledPara(StyledParagraph {
+                    style_id: None,
+                    direct_para_props: None,
+                    direct_char_props: None,
+                    inlines: vec![Inline::Str("x".into())],
+                    attr: NodeAttr::default(),
+                })
+            })
+            .collect(),
+    );
+    let table = Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![short, tall])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Table(Box::new(table))];
+
+    let mut r = resources();
+    let DocumentLayout::Paginated(PaginatedLayout { pages, .. }) = layout_document(
+        &mut r,
+        &doc,
+        LayoutMode::Paginated,
+        1.0,
+        &LayoutOptions {
+            preserve_for_editing: true,
+            spell: None,
+        },
+    ) else {
+        panic!("paginated layout expected");
+    };
+    pages
+        .iter()
+        .filter_map(|p| p.editing_data.as_ref())
+        .flat_map(|ed| ed.paragraphs.iter())
+        .find(|p| p.path == vec![PathStep::Cell { cell: 0, block: 0 }])
+        .expect("cell 0 editing paragraph")
+        .origin
+        .1
+}
+
+#[test]
+fn vertically_aligned_cell_caret_origin_follows_the_glyphs() {
+    // The caret origin must track the glyph translation applied for vertical
+    // alignment. Top stays at the cell top; Bottom and Middle push the origin
+    // down (Bottom furthest), matching where the text is actually painted.
+    let top = first_cell_origin_y(CellVerticalAlign::Top);
+    let middle = first_cell_origin_y(CellVerticalAlign::Middle);
+    let bottom = first_cell_origin_y(CellVerticalAlign::Bottom);
+
+    assert!(
+        middle > top + 1.0,
+        "middle origin {middle} should sit below top {top}"
+    );
+    assert!(
+        bottom > middle + 1.0,
+        "bottom origin {bottom} should sit below middle {middle}"
+    );
+}
diff --git a/loki-odf/Cargo.toml b/loki-odf/Cargo.toml
index 185c7776..d0b93ccb 100644
--- a/loki-odf/Cargo.toml
+++ b/loki-odf/Cargo.toml
@@ -26,6 +26,9 @@ features = ["std"]
 
 [dev-dependencies]
 loki-layout = { path = "../loki-layout" }
+# Spec 02 round-trip axis: the normalized-model differ + Document canonicalizer.
+appthere-conformance = { path = "../appthere-conformance", features = ["doc-model"] }
+loki-primitives = { path = "../loki-primitives" }
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/loki-odf/tests/conformance_round_trip.rs b/loki-odf/tests/conformance_round_trip.rs
new file mode 100644
index 00000000..04e2f913
--- /dev/null
+++ b/loki-odf/tests/conformance_round_trip.rs
@@ -0,0 +1,166 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Spec 02 round-trip axis — ODT **import-export-import** stability.
+//!
+//! Mirrors the DOCX shape (`loki-ooxml/tests/conformance_round_trip.rs`) for
+//! `loki-odf`'s ODT writer + reader. Both compared models are *imported*, so any
+//! divergence is a genuine export→re-import loss, reported with a model path by
+//! `appthere_conformance` rather than a bespoke per-field assertion.
+
+use std::io::Cursor;
+
+use appthere_conformance::model::canonicalize_document;
+use appthere_conformance::roundtrip::{Divergence, first_divergence};
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{BookmarkKind, Inline, StyledRun};
+use loki_doc_model::content::table::core::{Table, TableBody, TableCaption, TableFoot, TableHead};
+use loki_doc_model::content::table::row::{Cell, Row};
+use loki_doc_model::document::Document;
+use loki_doc_model::io::{DocumentExport, DocumentImport};
+use loki_doc_model::layout::section::Section;
+use loki_doc_model::style::props::char_props::CharProps;
+use loki_odf::odt::export::{OdtExport, OdtExportOptions};
+use loki_odf::odt::import::{OdtImport, OdtImportOptions};
+
+fn import(bytes: Vec<u8>) -> Document {
+    OdtImport::import(Cursor::new(bytes), OdtImportOptions::default()).expect("ODT should import")
+}
+
+fn export(doc: &Document) -> Vec<u8> {
+    let mut buf = Cursor::new(Vec::new());
+    OdtExport::export(doc, &mut buf, OdtExportOptions::default())
+        .expect("ODT export should succeed");
+    buf.into_inner()
+}
+
+/// First divergence of `seed` under ODT import-export-import (see the DOCX
+/// sibling for the rationale of comparing two *imported* models).
+fn round_trip_divergence(seed: &Document) -> Option<Divergence> {
+    let a = import(export(seed));
+    let b = import(export(&a));
+    first_divergence(&canonicalize_document(&a), &canonicalize_document(&b))
+}
+
+fn doc(blocks: Vec<Block>) -> Document {
+    let mut d = Document::default();
+    let mut s = Section::new();
+    s.blocks = blocks;
+    d.sections = vec![s];
+    d
+}
+
+fn styled_run(text: &str, props: CharProps) -> Inline {
+    Inline::StyledRun(StyledRun {
+        style_id: None,
+        direct_props: Some(Box::new(props)),
+        content: vec![Inline::Str(text.to_string())],
+        attr: NodeAttr::default(),
+    })
+}
+
+/// A single-body table whose cells hold the given paragraph texts.
+fn table(rows: Vec<Vec<&str>>) -> Block {
+    let body_rows = rows
+        .into_iter()
+        .map(|cells| {
+            Row::new(
+                cells
+                    .into_iter()
+                    .map(|t| Cell::simple(vec![Block::Para(vec![Inline::Str(t.to_string())])]))
+                    .collect(),
+            )
+        })
+        .collect();
+    Block::Table(Box::new(Table {
+        attr: NodeAttr::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: vec![],
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(body_rows)],
+        foot: TableFoot::empty(),
+    }))
+}
+
+/// Core word-processing content — paragraphs, a heading, a bold run, and a
+/// table — must survive an ODT export→re-import with no model divergence.
+#[test]
+fn odt_round_trip_preserves_core_content() {
+    let seed = doc(vec![
+        Block::Para(vec![Inline::Str("Hello world".to_string())]),
+        Block::Heading(
+            1,
+            NodeAttr::default(),
+            vec![Inline::Str("A heading".to_string())],
+        ),
+        Block::Para(vec![
+            Inline::Str("Some ".to_string()),
+            styled_run(
+                "bold",
+                CharProps {
+                    bold: Some(true),
+                    ..Default::default()
+                },
+            ),
+            Inline::Str(" text.".to_string()),
+        ]),
+        table(vec![vec!["A1", "A2"], vec!["B1", "B2"]]),
+    ]);
+
+    if let Some(d) = round_trip_divergence(&seed) {
+        panic!(
+            "core ODT round-trip diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
+
+/// Secondary run formatting (highlight, letter-spacing, all-caps) and bookmark
+/// anchors — which ODT export documents as lossless — must round-trip too. The
+/// same content class regressed silently on DOCX export before the symmetric
+/// `emit_char_props` fix; this guards the ODF path against the analogue.
+#[test]
+fn odt_round_trip_preserves_secondary_formatting() {
+    use loki_doc_model::style::props::char_props::HighlightColor;
+    use loki_primitives::units::Points;
+
+    let seed = doc(vec![
+        Block::Para(vec![
+            styled_run(
+                "highlighted",
+                CharProps {
+                    highlight_color: Some(HighlightColor::Yellow),
+                    ..Default::default()
+                },
+            ),
+            Inline::Str(" and ".to_string()),
+            styled_run(
+                "spaced",
+                CharProps {
+                    letter_spacing: Some(Points::new(2.0)),
+                    ..Default::default()
+                },
+            ),
+        ]),
+        Block::Para(vec![
+            Inline::Bookmark(BookmarkKind::Start, "mark1".to_string()),
+            styled_run(
+                "ALL CAPS",
+                CharProps {
+                    all_caps: Some(true),
+                    ..Default::default()
+                },
+            ),
+            Inline::Bookmark(BookmarkKind::End, "mark1".to_string()),
+        ]),
+    ]);
+
+    if let Some(d) = round_trip_divergence(&seed) {
+        panic!(
+            "secondary ODT round-trip diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
diff --git a/loki-ooxml/Cargo.toml b/loki-ooxml/Cargo.toml
index c6babdb1..6482c3a8 100644
--- a/loki-ooxml/Cargo.toml
+++ b/loki-ooxml/Cargo.toml
@@ -39,6 +39,9 @@ features = ["std"]
 [dev-dependencies]
 loki-opc    = { path = "../loki-opc" }
 loki-layout = { path = "../loki-layout" }
+# Spec 02 round-trip axis: the normalized-model differ + Document/Workbook
+# canonicalizers (doc-model for DOCX, sheet-model for XLSX).
+appthere-conformance = { path = "../appthere-conformance", features = ["doc-model", "sheet-model"] }
 zip = { version = "2", default-features = false, features = ["deflate"] }
 parley = "0.10"
 read-fonts = "0.40"
diff --git a/loki-ooxml/src/docx/write/document.rs b/loki-ooxml/src/docx/write/document.rs
index 85fedd4d..5a893bda 100644
--- a/loki-ooxml/src/docx/write/document.rs
+++ b/loki-ooxml/src/docx/write/document.rs
@@ -21,8 +21,8 @@ use loki_doc_model::style::catalog::StyleCatalog;
 use loki_doc_model::style::props::char_props::CharProps;
 
 use crate::docx::write::collector::ExportCollector;
+use crate::docx::write::run_props::emit_char_props;
 use crate::docx::write::section::write_sect_pr;
-use crate::docx::write::style_props::emit_char_props;
 use crate::docx::write::xml::{
     NS_A, NS_PIC, NS_R, NS_W, NS_WP, color_to_hex, pts_to_twips, write_decl, write_empty,
     write_end, write_start, wval,
@@ -829,7 +829,7 @@ fn write_inline<W: std::io::Write>(
 
             let _ = write_start(w, "w:r", &[]);
             let _ = write_start(w, "w:rPr", &[]);
-            let _ = write_empty(w, "w:vertAlign", &wval("superscript"));
+            // Superscript comes from the note-reference char style (styles.rs).
             let style = match kind {
                 NoteKind::Footnote => "FootnoteReference",
                 NoteKind::Endnote => "EndnoteReference",
diff --git a/loki-ooxml/src/docx/write/mod.rs b/loki-ooxml/src/docx/write/mod.rs
index 8e62a874..75a9f6c1 100644
--- a/loki-ooxml/src/docx/write/mod.rs
+++ b/loki-ooxml/src/docx/write/mod.rs
@@ -21,6 +21,7 @@ pub(super) mod media;
 mod metadata;
 mod numbering;
 mod rels;
+mod run_props;
 mod section;
 mod settings;
 mod style_props;
diff --git a/loki-ooxml/src/docx/write/run_props.rs b/loki-ooxml/src/docx/write/run_props.rs
new file mode 100644
index 00000000..8ab06e06
--- /dev/null
+++ b/loki-ooxml/src/docx/write/run_props.rs
@@ -0,0 +1,198 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! `<w:rPr>` run-property serializer shared by the styles writer and the
+//! document-body writer.
+//!
+//! The emitter is kept symmetric with the reader (`docx/reader/document.rs`):
+//! every run property the importer parses from `w:rPr` is written back here, so
+//! direct character formatting survives an export→re-import round-trip.
+//!
+//! ECMA-376 §17.3.2 (Run properties).
+
+use quick_xml::Writer;
+
+use loki_doc_model::style::props::char_props::{CharProps, HighlightColor};
+
+use crate::docx::write::xml::{
+    hex_color_val, pts_to_half_pts, pts_to_twips, write_empty, write_end, write_start, wval,
+};
+
+/// Writes a `<w:rPr>` element from [`CharProps`] (nothing if no field is set).
+pub(crate) fn write_char_props_elem<W: std::io::Write>(w: &mut Writer<W>, cp: &CharProps) {
+    let has_content = cp.bold.is_some()
+        || cp.italic.is_some()
+        || cp.underline.is_some()
+        || cp.strikethrough.is_some()
+        || cp.font_size.is_some()
+        || cp.font_name.is_some()
+        || cp.color.is_some()
+        || cp.background_color.is_some()
+        || cp.small_caps.is_some()
+        || cp.vertical_align.is_some();
+    if !has_content {
+        return;
+    }
+    let _ = write_start(w, "w:rPr", &[]);
+    emit_char_props(w, cp);
+    let _ = write_end(w, "w:rPr");
+}
+
+/// Emits `<w:rPr>` child elements for the given [`CharProps`] without the
+/// wrapping `<w:rPr>` tags (so callers can embed additional children).
+pub(crate) fn emit_char_props<W: std::io::Write>(w: &mut Writer<W>, cp: &CharProps) {
+    // A single `<w:rFonts>` carries the ascii/hAnsi, complex-script (cs), and
+    // East-Asian (eastAsia) faces — symmetric with the reader, which parses all
+    // three attributes from one element.
+    if cp.font_name.is_some() || cp.font_name_complex.is_some() || cp.font_name_east_asian.is_some()
+    {
+        let mut attrs: Vec<(&str, &str)> = Vec::new();
+        if let Some(ref font) = cp.font_name {
+            attrs.push(("w:ascii", font.as_str()));
+            attrs.push(("w:hAnsi", font.as_str()));
+        }
+        if let Some(ref font) = cp.font_name_complex {
+            attrs.push(("w:cs", font.as_str()));
+        }
+        if let Some(ref font) = cp.font_name_east_asian {
+            attrs.push(("w:eastAsia", font.as_str()));
+        }
+        let _ = write_empty(w, "w:rFonts", &attrs);
+    }
+    if cp.bold == Some(true) {
+        let _ = write_empty(w, "w:b", &[]);
+    }
+    if cp.italic == Some(true) {
+        let _ = write_empty(w, "w:i", &[]);
+    }
+    if cp.small_caps == Some(true) {
+        let _ = write_empty(w, "w:smallCaps", &[]);
+    }
+    if cp.all_caps == Some(true) {
+        let _ = write_empty(w, "w:caps", &[]);
+    }
+    if cp.shadow == Some(true) {
+        let _ = write_empty(w, "w:shadow", &[]);
+    }
+    if let Some(ref ul) = cp.underline {
+        use loki_doc_model::style::props::char_props::UnderlineStyle;
+        let v = match ul {
+            UnderlineStyle::Double => "double",
+            UnderlineStyle::Dotted => "dotted",
+            UnderlineStyle::Dash => "dash",
+            UnderlineStyle::Wave => "wave",
+            UnderlineStyle::Thick => "thick",
+            _ => "single",
+        };
+        let _ = write_empty(w, "w:u", &wval(v));
+    }
+    if let Some(ref st) = cp.strikethrough {
+        use loki_doc_model::style::props::char_props::StrikethroughStyle;
+        match st {
+            StrikethroughStyle::Double => {
+                let _ = write_empty(w, "w:dstrike", &[]);
+            }
+            _ => {
+                let _ = write_empty(w, "w:strike", &[]);
+            }
+        }
+    }
+    if let Some(ref va) = cp.vertical_align {
+        use loki_doc_model::style::props::char_props::VerticalAlign;
+        let v = match va {
+            VerticalAlign::Superscript => "superscript",
+            VerticalAlign::Subscript => "subscript",
+            _ => "baseline",
+        };
+        let _ = write_empty(w, "w:vertAlign", &wval(v));
+    }
+    if let Some(ref color) = cp.color
+        && let Some(hex) = color.to_hex()
+    {
+        let hex_val = hex_color_val(&hex);
+        let _ = write_empty(w, "w:color", &wval(&hex_val));
+    }
+    if let Some(pt) = cp.font_size {
+        let half = pts_to_half_pts(pt.value()).to_string();
+        let _ = write_empty(w, "w:sz", &wval(&half));
+    }
+    // Complex-script size is independent of `w:sz`; emit it from its own field
+    // (falling back to `w:sz` is the reader's job, not the writer's).
+    if let Some(pt) = cp.font_size_complex {
+        let half = pts_to_half_pts(pt.value()).to_string();
+        let _ = write_empty(w, "w:szCs", &wval(&half));
+    }
+    if let Some(h) = cp.highlight_color
+        && let Some(name) = highlight_val(h)
+    {
+        let _ = write_empty(w, "w:highlight", &wval(name));
+    }
+    if let Some(ref bg) = cp.background_color
+        && let Some(hex) = bg.to_hex()
+    {
+        // `w:val="clear"` with a fill round-trips through `resolve_shading`.
+        let fill = hex_color_val(&hex);
+        let _ = write_empty(w, "w:shd", &[("w:val", "clear"), ("w:fill", &fill)]);
+    }
+    // Letter spacing is stored in points; OOXML `w:spacing @w:val` is twips.
+    if let Some(ls) = cp.letter_spacing {
+        let twips = pts_to_twips(ls.value()).to_string();
+        let _ = write_empty(w, "w:spacing", &wval(&twips));
+    }
+    // Horizontal scale: model fraction (1.0 = 100%) → integer percent.
+    if let Some(scale) = cp.scale {
+        #[allow(clippy::cast_possible_truncation)] // bounded document measurement
+        let pct = (scale * 100.0).round() as i32;
+        let _ = write_empty(w, "w:w", &wval(&pct.to_string()));
+    }
+    // Kerning is a bool in the model; emit a non-zero half-point threshold when
+    // enabled (the reader maps any positive value back to `true`).
+    if let Some(kern) = cp.kerning {
+        let v = if kern { "2" } else { "0" };
+        let _ = write_empty(w, "w:kern", &wval(v));
+    }
+    if cp.language.is_some() || cp.language_complex.is_some() || cp.language_east_asian.is_some() {
+        let mut attrs: Vec<(&str, &str)> = Vec::new();
+        if let Some(ref l) = cp.language {
+            attrs.push(("w:val", l.as_str()));
+        }
+        if let Some(ref l) = cp.language_complex {
+            attrs.push(("w:bidi", l.as_str()));
+        }
+        if let Some(ref l) = cp.language_east_asian {
+            attrs.push(("w:eastAsia", l.as_str()));
+        }
+        let _ = write_empty(w, "w:lang", &attrs);
+    }
+}
+
+/// Reverse of the import `map_highlight`: a [`HighlightColor`] to its OOXML
+/// `w:highlight @w:val` token. `None` (no highlight) yields `None`.
+fn highlight_val(h: HighlightColor) -> Option<&'static str> {
+    use HighlightColor as H;
+    Some(match h {
+        H::Black => "black",
+        H::Blue => "blue",
+        H::Cyan => "cyan",
+        H::DarkBlue => "darkBlue",
+        H::DarkCyan => "darkCyan",
+        H::DarkGray => "darkGray",
+        H::DarkGreen => "darkGreen",
+        H::DarkMagenta => "darkMagenta",
+        H::DarkRed => "darkRed",
+        H::DarkYellow => "darkYellow",
+        H::Green => "green",
+        H::LightGray => "lightGray",
+        H::Magenta => "magenta",
+        H::Red => "red",
+        H::White => "white",
+        H::Yellow => "yellow",
+        // `H::None` (no highlight) and any future `#[non_exhaustive]` variant
+        // emit nothing rather than a wrong colour.
+        _ => return None,
+    })
+}
+
+#[cfg(test)]
+#[path = "run_props_tests.rs"]
+mod tests;
diff --git a/loki-ooxml/src/docx/write/run_props_tests.rs b/loki-ooxml/src/docx/write/run_props_tests.rs
new file mode 100644
index 00000000..a9e73459
--- /dev/null
+++ b/loki-ooxml/src/docx/write/run_props_tests.rs
@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use loki_doc_model::style::props::char_props::{CharProps, HighlightColor};
+use loki_primitives::units::Points;
+
+use super::emit_char_props;
+
+/// Renders `cp` through [`emit_char_props`] and returns the UTF-8 XML fragment.
+fn emit(cp: &CharProps) -> String {
+    let mut buf = Vec::new();
+    let mut w = quick_xml::Writer::new(&mut buf);
+    emit_char_props(&mut w, cp);
+    String::from_utf8(buf).expect("XML is valid UTF-8")
+}
+
+#[test]
+fn highlight_is_emitted() {
+    let cp = CharProps {
+        highlight_color: Some(HighlightColor::Yellow),
+        ..Default::default()
+    };
+    assert!(emit(&cp).contains(r#"<w:highlight w:val="yellow"/>"#));
+}
+
+#[test]
+fn highlight_none_emits_nothing() {
+    let cp = CharProps {
+        highlight_color: Some(HighlightColor::None),
+        ..Default::default()
+    };
+    assert!(!emit(&cp).contains("w:highlight"));
+}
+
+#[test]
+fn letter_spacing_is_emitted_in_twips() {
+    // 2 pt → 40 twips (the reference fixture's `w:spacing w:val="40"`).
+    let cp = CharProps {
+        letter_spacing: Some(Points::new(2.0)),
+        ..Default::default()
+    };
+    assert!(emit(&cp).contains(r#"<w:spacing w:val="40"/>"#));
+}
+
+#[test]
+fn all_caps_and_shadow_are_emitted() {
+    let cp = CharProps {
+        all_caps: Some(true),
+        shadow: Some(true),
+        ..Default::default()
+    };
+    let xml = emit(&cp);
+    assert!(xml.contains("<w:caps/>"), "xml = {xml}");
+    assert!(xml.contains("<w:shadow/>"), "xml = {xml}");
+}
+
+#[test]
+fn scale_emits_integer_percent() {
+    let cp = CharProps {
+        scale: Some(1.5),
+        ..Default::default()
+    };
+    assert!(emit(&cp).contains(r#"<w:w w:val="150"/>"#));
+}
+
+#[test]
+fn kerning_emits_threshold_and_disabled_zero() {
+    let on = CharProps {
+        kerning: Some(true),
+        ..Default::default()
+    };
+    assert!(emit(&on).contains(r#"<w:kern w:val="2"/>"#));
+    let off = CharProps {
+        kerning: Some(false),
+        ..Default::default()
+    };
+    assert!(emit(&off).contains(r#"<w:kern w:val="0"/>"#));
+}
+
+#[test]
+fn complex_font_and_size_are_emitted() {
+    let cp = CharProps {
+        font_name_complex: Some("Arabic Typesetting".to_string()),
+        font_size_complex: Some(Points::new(14.0)),
+        ..Default::default()
+    };
+    let xml = emit(&cp);
+    assert!(xml.contains(r#"w:cs="Arabic Typesetting""#), "xml = {xml}");
+    assert!(xml.contains(r#"<w:szCs w:val="28"/>"#), "xml = {xml}");
+}
diff --git a/loki-ooxml/src/docx/write/style_props.rs b/loki-ooxml/src/docx/write/style_props.rs
index 7ec4cc76..1d940626 100644
--- a/loki-ooxml/src/docx/write/style_props.rs
+++ b/loki-ooxml/src/docx/write/style_props.rs
@@ -1,19 +1,17 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2026 AppThere Loki contributors
 
-//! `<w:pPr>` / `<w:rPr>` property serializers shared by the styles writer and
-//! the document-body writer.
+//! `<w:pPr>` paragraph-property serializers shared by the styles writer and the
+//! document-body writer. Run (`<w:rPr>`) properties live in the sibling
+//! [`run_props`](super::run_props) module.
 //!
 //! ECMA-376 §17.3 (Paragraph and run properties).
 
 use quick_xml::Writer;
 
-use loki_doc_model::style::props::char_props::CharProps;
 use loki_doc_model::style::props::para_props::{LineHeight, ParaProps, Spacing};
 
-use crate::docx::write::xml::{
-    hex_color_val, pts_to_half_pts, pts_to_twips, write_empty, write_end, write_start, wval,
-};
+use crate::docx::write::xml::{pts_to_twips, write_empty, write_end, write_start, wval};
 
 /// Writes a `<w:pPr>` element from [`ParaProps`] (nothing if no field is set).
 pub(super) fn write_para_props_elem<W: std::io::Write>(w: &mut Writer<W>, pp: &ParaProps) {
@@ -131,87 +129,3 @@ fn spacing_twips(s: Spacing) -> i32 {
         _ => 0,
     }
 }
-
-/// Writes a `<w:rPr>` element from [`CharProps`] (nothing if no field is set).
-pub(super) fn write_char_props_elem<W: std::io::Write>(w: &mut Writer<W>, cp: &CharProps) {
-    let has_content = cp.bold.is_some()
-        || cp.italic.is_some()
-        || cp.underline.is_some()
-        || cp.strikethrough.is_some()
-        || cp.font_size.is_some()
-        || cp.font_name.is_some()
-        || cp.color.is_some()
-        || cp.background_color.is_some()
-        || cp.small_caps.is_some()
-        || cp.vertical_align.is_some();
-    if !has_content {
-        return;
-    }
-    let _ = write_start(w, "w:rPr", &[]);
-    emit_char_props(w, cp);
-    let _ = write_end(w, "w:rPr");
-}
-
-/// Emits `<w:rPr>` child elements for the given [`CharProps`] without the
-/// wrapping `<w:rPr>` tags (so callers can embed additional children).
-pub(crate) fn emit_char_props<W: std::io::Write>(w: &mut Writer<W>, cp: &CharProps) {
-    if let Some(ref font) = cp.font_name {
-        let _ = write_empty(
-            w,
-            "w:rFonts",
-            &[("w:ascii", font.as_str()), ("w:hAnsi", font.as_str())],
-        );
-    }
-    if cp.bold == Some(true) {
-        let _ = write_empty(w, "w:b", &[]);
-    }
-    if cp.italic == Some(true) {
-        let _ = write_empty(w, "w:i", &[]);
-    }
-    if cp.small_caps == Some(true) {
-        let _ = write_empty(w, "w:smallCaps", &[]);
-    }
-    if let Some(ref ul) = cp.underline {
-        use loki_doc_model::style::props::char_props::UnderlineStyle;
-        let v = match ul {
-            UnderlineStyle::Double => "double",
-            UnderlineStyle::Dotted => "dotted",
-            UnderlineStyle::Dash => "dash",
-            UnderlineStyle::Wave => "wave",
-            UnderlineStyle::Thick => "thick",
-            _ => "single",
-        };
-        let _ = write_empty(w, "w:u", &wval(v));
-    }
-    if let Some(ref st) = cp.strikethrough {
-        use loki_doc_model::style::props::char_props::StrikethroughStyle;
-        match st {
-            StrikethroughStyle::Double => {
-                let _ = write_empty(w, "w:dstrike", &[]);
-            }
-            _ => {
-                let _ = write_empty(w, "w:strike", &[]);
-            }
-        }
-    }
-    if let Some(ref va) = cp.vertical_align {
-        use loki_doc_model::style::props::char_props::VerticalAlign;
-        let v = match va {
-            VerticalAlign::Superscript => "superscript",
-            VerticalAlign::Subscript => "subscript",
-            _ => "baseline",
-        };
-        let _ = write_empty(w, "w:vertAlign", &wval(v));
-    }
-    if let Some(ref color) = cp.color
-        && let Some(hex) = color.to_hex()
-    {
-        let hex_val = hex_color_val(&hex);
-        let _ = write_empty(w, "w:color", &wval(&hex_val));
-    }
-    if let Some(pt) = cp.font_size {
-        let half = pts_to_half_pts(pt.value()).to_string();
-        let _ = write_empty(w, "w:sz", &wval(&half));
-        let _ = write_empty(w, "w:szCs", &wval(&half));
-    }
-}
diff --git a/loki-ooxml/src/docx/write/styles.rs b/loki-ooxml/src/docx/write/styles.rs
index 94ed297d..b3f86f85 100644
--- a/loki-ooxml/src/docx/write/styles.rs
+++ b/loki-ooxml/src/docx/write/styles.rs
@@ -16,7 +16,8 @@ use quick_xml::Writer;
 use loki_doc_model::style::catalog::{StyleCatalog, StyleId};
 use loki_doc_model::style::para_style::ParagraphStyle;
 
-use crate::docx::write::style_props::{write_char_props_elem, write_para_props_elem};
+use crate::docx::write::run_props::write_char_props_elem;
+use crate::docx::write::style_props::write_para_props_elem;
 use crate::docx::write::xml::{NS_W, write_decl, write_empty, write_end, write_start, wval};
 
 /// Built-in heading definitions: (styleId, display name, font size half-pts, bold, outline level).
@@ -91,6 +92,24 @@ pub(super) fn write_styles_xml(catalog: &StyleCatalog) -> Vec<u8> {
         let _ = write_end(&mut w, "w:style");
     }
 
+    // Built-in note-reference character styles. These carry the superscript for
+    // footnote/endnote markers (the body writer references them by id rather
+    // than emitting an explicit `<w:vertAlign>` on each marker run). Word always
+    // includes them; emit defaults only when the catalog did not already define
+    // them above, so an imported style with edited props still wins.
+    if !catalog
+        .character_styles
+        .contains_key(&StyleId::new("FootnoteReference"))
+    {
+        write_note_reference_style(&mut w, "FootnoteReference", "footnote reference");
+    }
+    if !catalog
+        .character_styles
+        .contains_key(&StyleId::new("EndnoteReference"))
+    {
+        write_note_reference_style(&mut w, "EndnoteReference", "endnote reference");
+    }
+
     let _ = write_end(&mut w, "w:styles");
     drop(w);
     out
@@ -205,3 +224,18 @@ fn write_default_heading<W: std::io::Write>(
 
     let _ = write_end(w, "w:style");
 }
+
+/// Writes a built-in `<w:style w:type="character">` for a footnote/endnote
+/// reference: only the superscript run property, matching Word's defaults.
+fn write_note_reference_style<W: std::io::Write>(w: &mut Writer<W>, style_id: &str, name: &str) {
+    let _ = write_start(
+        w,
+        "w:style",
+        &[("w:type", "character"), ("w:styleId", style_id)],
+    );
+    let _ = write_empty(w, "w:name", &wval(name));
+    let _ = write_start(w, "w:rPr", &[]);
+    let _ = write_empty(w, "w:vertAlign", &wval("superscript"));
+    let _ = write_end(w, "w:rPr");
+    let _ = write_end(w, "w:style");
+}
diff --git a/loki-ooxml/src/xlsx/export.rs b/loki-ooxml/src/xlsx/export.rs
index e0675782..8fc63295 100644
--- a/loki-ooxml/src/xlsx/export.rs
+++ b/loki-ooxml/src/xlsx/export.rs
@@ -368,7 +368,10 @@ fn generate_sheet_xml(
     row_indices.sort_unstable();
 
     for r in row_indices {
-        let mut cols = rows.remove(&r).unwrap();
+        // `row_indices` are exactly `rows`' keys, so `remove` is always `Some`.
+        let Some(mut cols) = rows.remove(&r) else {
+            continue;
+        };
         cols.sort_unstable_by_key(|&(c, _)| c);
 
         xml.push_str(&format!("    <row r=\"{}\">\n", r + 1));
diff --git a/loki-ooxml/src/xml_util.rs b/loki-ooxml/src/xml_util.rs
index cea3e447..e872c343 100644
--- a/loki-ooxml/src/xml_util.rs
+++ b/loki-ooxml/src/xml_util.rs
@@ -184,180 +184,5 @@ fn blend_rgb(bg: RgbColor, fg: RgbColor, t: f32) -> RgbColor {
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-
-    // ── bool_attr ─────────────────────────────────────────────────────────────
-
-    #[test]
-    fn bool_attr_true_values() {
-        assert!(bool_attr("1"));
-        assert!(bool_attr("true"));
-        assert!(bool_attr("on"));
-        // Unknown values also default to true per ECMA-376 §17.7.3
-        assert!(bool_attr("yes"));
-        assert!(bool_attr(""));
-    }
-
-    #[test]
-    fn bool_attr_false_values() {
-        assert!(!bool_attr("0"));
-        assert!(!bool_attr("false"));
-        assert!(!bool_attr("off"));
-    }
-
-    // ── twips_to_points ───────────────────────────────────────────────────────
-
-    #[test]
-    fn twips_to_points_zero() {
-        assert_eq!(twips_to_points(0).value(), 0.0);
-    }
-
-    #[test]
-    fn twips_to_points_one_pt() {
-        assert_eq!(twips_to_points(20).value(), 1.0);
-    }
-
-    #[test]
-    fn twips_to_points_720() {
-        // 720 twips = 36 pt
-        assert_eq!(twips_to_points(720).value(), 36.0);
-    }
-
-    #[test]
-    fn twips_to_points_negative() {
-        assert_eq!(twips_to_points(-20).value(), -1.0);
-    }
-
-    // ── half_points_to_points ─────────────────────────────────────────────────
-
-    #[test]
-    fn half_points_to_points_24() {
-        // 24 half-points = 12 pt
-        assert_eq!(half_points_to_points(24).value(), 12.0);
-    }
-
-    #[test]
-    fn half_points_to_points_zero() {
-        assert_eq!(half_points_to_points(0).value(), 0.0);
-    }
-
-    // ── emu_to_points ─────────────────────────────────────────────────────────
-
-    #[test]
-    fn emu_to_points_one_pt() {
-        assert_eq!(emu_to_points(12700).value(), 1.0);
-    }
-
-    #[test]
-    fn emu_to_points_one_inch() {
-        // 914400 EMU = 72 pt
-        assert!((emu_to_points(914_400).value() - 72.0).abs() < f64::EPSILON);
-    }
-
-    #[test]
-    fn emu_to_points_zero() {
-        assert_eq!(emu_to_points(0).value(), 0.0);
-    }
-
-    // ── hex_color ─────────────────────────────────────────────────────────────
-
-    #[test]
-    fn hex_color_red() {
-        let c = hex_color("FF0000").unwrap();
-        assert!((c.red() - 1.0_f32).abs() < 1e-6);
-        assert!(c.green() < 1e-6);
-        assert!(c.blue() < 1e-6);
-    }
-
-    #[test]
-    fn hex_color_black() {
-        let c = hex_color("000000").unwrap();
-        assert!(c.red() < 1e-6);
-        assert!(c.green() < 1e-6);
-        assert!(c.blue() < 1e-6);
-    }
-
-    #[test]
-    fn hex_color_white() {
-        let c = hex_color("FFFFFF").unwrap();
-        assert!((c.red() - 1.0_f32).abs() < 1e-6);
-        assert!((c.green() - 1.0_f32).abs() < 1e-6);
-        assert!((c.blue() - 1.0_f32).abs() < 1e-6);
-    }
-
-    #[test]
-    fn hex_color_auto_is_none() {
-        assert!(hex_color("auto").is_none());
-    }
-
-    #[test]
-    fn hex_color_empty_is_none() {
-        assert!(hex_color("").is_none());
-    }
-
-    #[test]
-    fn hex_color_invalid_chars_is_none() {
-        assert!(hex_color("GGGGGG").is_none());
-    }
-
-    #[test]
-    fn hex_color_wrong_length_is_none() {
-        assert!(hex_color("FFF").is_none());
-        assert!(hex_color("FFFFFFF").is_none());
-    }
-
-    #[test]
-    fn hex_color_lowercase() {
-        // OOXML emits uppercase but parsers should tolerate lowercase
-        let c = hex_color("ff8000").unwrap();
-        assert!((c.red() - 1.0_f32).abs() < 1e-6);
-        assert!((c.green() - 128.0_f32 / 255.0).abs() < 1e-4);
-        assert!(c.blue() < 1e-6);
-    }
-
-    // ── resolve_shading ───────────────────────────────────────────────────────
-
-    #[test]
-    fn shading_clear_uses_fill() {
-        let c = resolve_shading(Some("CADCFC"), Some("clear"), None).unwrap();
-        assert!((c.red() - 0xCA as f32 / 255.0).abs() < 1e-4);
-        assert!((c.blue() - 0xFC as f32 / 255.0).abs() < 1e-4);
-    }
-
-    #[test]
-    fn shading_clear_auto_fill_is_none() {
-        // The common no-op shading `<w:shd val="clear" fill="auto"/>`.
-        assert!(resolve_shading(Some("auto"), Some("clear"), Some("auto")).is_none());
-    }
-
-    #[test]
-    fn shading_solid_uses_color() {
-        let c = resolve_shading(Some("FFFFFF"), Some("solid"), Some("1C7293")).unwrap();
-        assert!((c.red() - 0x1C as f32 / 255.0).abs() < 1e-4);
-        assert!((c.green() - 0x72 as f32 / 255.0).abs() < 1e-4);
-    }
-
-    #[test]
-    fn shading_pct25_blends_color_over_fill() {
-        // 25 % of teal (1C7293) over white (FFFFFF) → light teal.
-        let c = resolve_shading(Some("FFFFFF"), Some("pct25"), Some("1C7293")).unwrap();
-        let expect = |fg: f32| 1.0 * 0.75 + fg * 0.25;
-        assert!((c.red() - expect(0x1C as f32 / 255.0)).abs() < 1e-4);
-        assert!((c.green() - expect(0x72 as f32 / 255.0)).abs() < 1e-4);
-        assert!((c.blue() - expect(0x93 as f32 / 255.0)).abs() < 1e-4);
-        // The result must be lighter than the solid foreground (visible shade).
-        assert!(c.red() > 0x1C as f32 / 255.0);
-    }
-
-    #[test]
-    fn shading_nil_is_none() {
-        assert!(resolve_shading(Some("CADCFC"), Some("nil"), None).is_none());
-    }
-
-    #[test]
-    fn shading_unknown_texture_falls_back_to_fill() {
-        let c = resolve_shading(Some("97BC62"), Some("horzStripe"), Some("000000")).unwrap();
-        assert!((c.green() - 0xBC as f32 / 255.0).abs() < 1e-4);
-    }
-}
+#[path = "xml_util_tests.rs"]
+mod tests;
diff --git a/loki-ooxml/src/xml_util_tests.rs b/loki-ooxml/src/xml_util_tests.rs
new file mode 100644
index 00000000..9d45dd11
--- /dev/null
+++ b/loki-ooxml/src/xml_util_tests.rs
@@ -0,0 +1,178 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::*;
+
+// ── bool_attr ─────────────────────────────────────────────────────────────
+
+#[test]
+fn bool_attr_true_values() {
+    assert!(bool_attr("1"));
+    assert!(bool_attr("true"));
+    assert!(bool_attr("on"));
+    // Unknown values also default to true per ECMA-376 §17.7.3
+    assert!(bool_attr("yes"));
+    assert!(bool_attr(""));
+}
+
+#[test]
+fn bool_attr_false_values() {
+    assert!(!bool_attr("0"));
+    assert!(!bool_attr("false"));
+    assert!(!bool_attr("off"));
+}
+
+// ── twips_to_points ───────────────────────────────────────────────────────
+
+#[test]
+fn twips_to_points_zero() {
+    assert_eq!(twips_to_points(0).value(), 0.0);
+}
+
+#[test]
+fn twips_to_points_one_pt() {
+    assert_eq!(twips_to_points(20).value(), 1.0);
+}
+
+#[test]
+fn twips_to_points_720() {
+    // 720 twips = 36 pt
+    assert_eq!(twips_to_points(720).value(), 36.0);
+}
+
+#[test]
+fn twips_to_points_negative() {
+    assert_eq!(twips_to_points(-20).value(), -1.0);
+}
+
+// ── half_points_to_points ─────────────────────────────────────────────────
+
+#[test]
+fn half_points_to_points_24() {
+    // 24 half-points = 12 pt
+    assert_eq!(half_points_to_points(24).value(), 12.0);
+}
+
+#[test]
+fn half_points_to_points_zero() {
+    assert_eq!(half_points_to_points(0).value(), 0.0);
+}
+
+// ── emu_to_points ─────────────────────────────────────────────────────────
+
+#[test]
+fn emu_to_points_one_pt() {
+    assert_eq!(emu_to_points(12700).value(), 1.0);
+}
+
+#[test]
+fn emu_to_points_one_inch() {
+    // 914400 EMU = 72 pt
+    assert!((emu_to_points(914_400).value() - 72.0).abs() < f64::EPSILON);
+}
+
+#[test]
+fn emu_to_points_zero() {
+    assert_eq!(emu_to_points(0).value(), 0.0);
+}
+
+// ── hex_color ─────────────────────────────────────────────────────────────
+
+#[test]
+fn hex_color_red() {
+    let c = hex_color("FF0000").unwrap();
+    assert!((c.red() - 1.0_f32).abs() < 1e-6);
+    assert!(c.green() < 1e-6);
+    assert!(c.blue() < 1e-6);
+}
+
+#[test]
+fn hex_color_black() {
+    let c = hex_color("000000").unwrap();
+    assert!(c.red() < 1e-6);
+    assert!(c.green() < 1e-6);
+    assert!(c.blue() < 1e-6);
+}
+
+#[test]
+fn hex_color_white() {
+    let c = hex_color("FFFFFF").unwrap();
+    assert!((c.red() - 1.0_f32).abs() < 1e-6);
+    assert!((c.green() - 1.0_f32).abs() < 1e-6);
+    assert!((c.blue() - 1.0_f32).abs() < 1e-6);
+}
+
+#[test]
+fn hex_color_auto_is_none() {
+    assert!(hex_color("auto").is_none());
+}
+
+#[test]
+fn hex_color_empty_is_none() {
+    assert!(hex_color("").is_none());
+}
+
+#[test]
+fn hex_color_invalid_chars_is_none() {
+    assert!(hex_color("GGGGGG").is_none());
+}
+
+#[test]
+fn hex_color_wrong_length_is_none() {
+    assert!(hex_color("FFF").is_none());
+    assert!(hex_color("FFFFFFF").is_none());
+}
+
+#[test]
+fn hex_color_lowercase() {
+    // OOXML emits uppercase but parsers should tolerate lowercase
+    let c = hex_color("ff8000").unwrap();
+    assert!((c.red() - 1.0_f32).abs() < 1e-6);
+    assert!((c.green() - 128.0_f32 / 255.0).abs() < 1e-4);
+    assert!(c.blue() < 1e-6);
+}
+
+// ── resolve_shading ───────────────────────────────────────────────────────
+
+#[test]
+fn shading_clear_uses_fill() {
+    let c = resolve_shading(Some("CADCFC"), Some("clear"), None).unwrap();
+    assert!((c.red() - 0xCA as f32 / 255.0).abs() < 1e-4);
+    assert!((c.blue() - 0xFC as f32 / 255.0).abs() < 1e-4);
+}
+
+#[test]
+fn shading_clear_auto_fill_is_none() {
+    // The common no-op shading `<w:shd val="clear" fill="auto"/>`.
+    assert!(resolve_shading(Some("auto"), Some("clear"), Some("auto")).is_none());
+}
+
+#[test]
+fn shading_solid_uses_color() {
+    let c = resolve_shading(Some("FFFFFF"), Some("solid"), Some("1C7293")).unwrap();
+    assert!((c.red() - 0x1C as f32 / 255.0).abs() < 1e-4);
+    assert!((c.green() - 0x72 as f32 / 255.0).abs() < 1e-4);
+}
+
+#[test]
+fn shading_pct25_blends_color_over_fill() {
+    // 25 % of teal (1C7293) over white (FFFFFF) → light teal.
+    let c = resolve_shading(Some("FFFFFF"), Some("pct25"), Some("1C7293")).unwrap();
+    let expect = |fg: f32| 1.0 * 0.75 + fg * 0.25;
+    assert!((c.red() - expect(0x1C as f32 / 255.0)).abs() < 1e-4);
+    assert!((c.green() - expect(0x72 as f32 / 255.0)).abs() < 1e-4);
+    assert!((c.blue() - expect(0x93 as f32 / 255.0)).abs() < 1e-4);
+    // The result must be lighter than the solid foreground (visible shade).
+    assert!(c.red() > 0x1C as f32 / 255.0);
+}
+
+#[test]
+fn shading_nil_is_none() {
+    assert!(resolve_shading(Some("CADCFC"), Some("nil"), None).is_none());
+}
+
+#[test]
+fn shading_unknown_texture_falls_back_to_fill() {
+    let c = resolve_shading(Some("97BC62"), Some("horzStripe"), Some("000000")).unwrap();
+    assert!((c.green() - 0xBC as f32 / 255.0).abs() < 1e-4);
+}
diff --git a/loki-ooxml/tests/comments_round_trip.rs b/loki-ooxml/tests/comments_round_trip.rs
index 1d1aa570..76108508 100644
--- a/loki-ooxml/tests/comments_round_trip.rs
+++ b/loki-ooxml/tests/comments_round_trip.rs
@@ -6,6 +6,8 @@
 
 use std::io::Cursor;
 
+use appthere_conformance::model::canonicalize_document;
+use appthere_conformance::roundtrip::first_divergence;
 use chrono::TimeZone;
 use loki_doc_model::content::annotation::{Comment, CommentRef, CommentRefKind};
 use loki_doc_model::content::block::Block;
@@ -15,6 +17,16 @@ use loki_doc_model::io::DocumentExport;
 use loki_ooxml::DocxExport;
 use loki_ooxml::docx::import::{DocxImportOptions, DocxImporter};
 
+/// One export→re-import cycle.
+fn export_import(doc: &Document) -> Document {
+    let mut buf = Cursor::new(Vec::new());
+    DocxExport::export(doc, &mut buf, ()).expect("export should succeed");
+    DocxImporter::new(DocxImportOptions::default())
+        .run(Cursor::new(buf.into_inner()))
+        .expect("re-import should succeed")
+        .document
+}
+
 fn doc_with_comment() -> Document {
     // "Hello [commented]world[/commented]!" with comment id "0".
     let para = Block::Para(vec![
@@ -59,12 +71,19 @@ fn anchors(doc: &Document) -> Vec<(String, CommentRefKind)> {
 fn comment_range_and_body_round_trip() {
     let doc = doc_with_comment();
 
-    let mut buf = Cursor::new(Vec::new());
-    DocxExport::export(&doc, &mut buf, ()).expect("export should succeed");
-    let re = DocxImporter::new(DocxImportOptions::default())
-        .run(Cursor::new(buf.into_inner()))
-        .expect("re-import should succeed")
-        .document;
+    let re = export_import(&doc);
+
+    // Whole-model differ backstop: the commented range's anchors live in the
+    // body flow, so a second cycle must introduce no divergence — catching any
+    // anchor displacement the targeted assertions below do not check. (The
+    // comment *body* lives in `doc.comments`, outside the body canonical form.)
+    let re2 = export_import(&re);
+    if let Some(d) = first_divergence(&canonicalize_document(&re), &canonicalize_document(&re2)) {
+        panic!(
+            "comment body-flow round-trip diverged at `{}`:\n  {:?}\n  {:?}",
+            d.path, d.left, d.right
+        );
+    }
 
     // The start/end anchors survive in the content flow.
     let got = anchors(&re);
diff --git a/loki-ooxml/tests/conformance_round_trip.rs b/loki-ooxml/tests/conformance_round_trip.rs
new file mode 100644
index 00000000..ed63cdd9
--- /dev/null
+++ b/loki-ooxml/tests/conformance_round_trip.rs
@@ -0,0 +1,170 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Spec 02 round-trip axis — DOCX **import-export-import** stability.
+//!
+//! Both compared models are *imported*, so structural normalization is
+//! identical and any divergence is a genuine export-then-reimport loss,
+//! reported with a model path (`appthere_conformance`) rather than a boolean.
+
+mod helpers;
+
+use std::io::Cursor;
+
+use appthere_conformance::model::canonicalize_document;
+use appthere_conformance::roundtrip::{Divergence, first_divergence};
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{BookmarkKind, Inline, StyledRun};
+use loki_doc_model::document::Document;
+use loki_doc_model::io::{DocumentExport, DocumentImport};
+use loki_doc_model::layout::section::Section;
+use loki_doc_model::style::props::char_props::{CharProps, HighlightColor};
+use loki_ooxml::docx::export::DocxExport;
+use loki_ooxml::docx::import::{DocxImport, DocxImportOptions};
+use loki_primitives::units::Points;
+
+fn import(bytes: Vec<u8>) -> Document {
+    DocxImport::import(Cursor::new(bytes), DocxImportOptions::default())
+        .expect("DOCX should import")
+}
+
+fn export(doc: &Document) -> Vec<u8> {
+    let mut buf = Cursor::new(Vec::new());
+    DocxExport::export(doc, &mut buf, ()).expect("DOCX export should succeed");
+    buf.into_inner()
+}
+
+/// Returns the first divergence of `seed` under DOCX import-export-import.
+///
+/// `seed` is exported and imported once to reach the import-canonical shape
+/// (`a`), then exported and imported again (`b`); `a` and `b` are compared. This
+/// isolates export→reimport loss from the consumer's hand-built model shape.
+fn round_trip_divergence(seed: &Document) -> Option<Divergence> {
+    let a = import(export(seed));
+    let b = import(export(&a));
+    first_divergence(&canonicalize_document(&a), &canonicalize_document(&b))
+}
+
+fn doc(blocks: Vec<Block>) -> Document {
+    let mut d = Document::default();
+    let mut s = Section::new();
+    s.blocks = blocks;
+    d.sections = vec![s];
+    d
+}
+
+fn styled_run(text: &str, props: CharProps) -> Inline {
+    Inline::StyledRun(StyledRun {
+        style_id: None,
+        direct_props: Some(Box::new(props)),
+        content: vec![Inline::Str(text.to_string())],
+        attr: NodeAttr::default(),
+    })
+}
+
+fn bold_run(text: &str) -> Inline {
+    styled_run(
+        text,
+        CharProps {
+            bold: Some(true),
+            ..Default::default()
+        },
+    )
+}
+
+/// Core word-processing content — plain paragraphs, a bold run, a heading, and a
+/// bookmark — must survive a DOCX export→re-import with no model divergence.
+#[test]
+fn docx_round_trip_preserves_core_content() {
+    let seed = doc(vec![
+        Block::Para(vec![Inline::Str("Hello world".to_string())]),
+        Block::Heading(
+            1,
+            NodeAttr::default(),
+            vec![Inline::Str("A heading".to_string())],
+        ),
+        Block::Para(vec![
+            Inline::Str("Some ".to_string()),
+            bold_run("bold"),
+            Inline::Str(" text.".to_string()),
+        ]),
+        Block::Para(vec![
+            Inline::Bookmark(BookmarkKind::Start, "mark1".to_string()),
+            Inline::Str("anchored".to_string()),
+            Inline::Bookmark(BookmarkKind::End, "mark1".to_string()),
+        ]),
+    ]);
+
+    if let Some(d) = round_trip_divergence(&seed) {
+        panic!(
+            "core DOCX round-trip diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
+
+/// Regression for the export gap surfaced by the conformance harness: runs whose
+/// *only* direct formatting was highlight, letter-spacing, all-caps, or scale
+/// used to export with an empty `<w:rPr>`, collapse to plain runs, and merge with
+/// their neighbours — silently dropping the `StyledRun` wrapper (and, via run
+/// merging, adjacent text). Each must now survive import-export-import intact.
+#[test]
+fn docx_round_trip_preserves_secondary_run_formatting() {
+    let highlighted = CharProps {
+        highlight_color: Some(HighlightColor::Yellow),
+        ..Default::default()
+    };
+    let letter_spaced = CharProps {
+        letter_spacing: Some(Points::new(2.0)),
+        ..Default::default()
+    };
+    let all_caps = CharProps {
+        all_caps: Some(true),
+        ..Default::default()
+    };
+
+    let seed = doc(vec![
+        Block::Para(vec![
+            styled_run("highlighted", highlighted),
+            Inline::Str(" and ".to_string()),
+            styled_run("letter-spaced", letter_spaced),
+        ]),
+        Block::Para(vec![
+            styled_run("ALL CAPS", all_caps),
+            Inline::Str(" plain tail.".to_string()),
+        ]),
+    ]);
+
+    if let Some(d) = round_trip_divergence(&seed) {
+        panic!(
+            "secondary run formatting diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
+
+/// The comprehensive reference fixture (headers, footnotes, hyperlinks, images,
+/// …) under the same import-export-import comparison.
+///
+/// This started as an `#[ignore]`'d gap-finder and is now a **green guard**: the
+/// conformance harness surfaced two real export bugs which have since been fixed
+/// — the content-loss gap at `blk0005` (highlight / letter-spacing runs
+/// collapsing and dropping adjacent text; fixed by making `emit_char_props`
+/// symmetric with the reader) and the footnote-reference instability at
+/// `blk0026` (export hard-coded an explicit `<w:vertAlign>` the source model
+/// never had; the superscript now lives only in the always-emitted
+/// `FootnoteReference` character style). The full reference fixture now
+/// round-trips with **no model divergence**. Any future export regression that
+/// drops or fabricates a canonicalised property fails here with a model path.
+#[test]
+fn docx_reference_round_trip_is_stable() {
+    let a = import(helpers::build_reference_docx());
+    let b = import(export(&a));
+    if let Some(d) = first_divergence(&canonicalize_document(&a), &canonicalize_document(&b)) {
+        panic!(
+            "reference DOCX round-trip diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
diff --git a/loki-ooxml/tests/conformance_xlsx_round_trip.rs b/loki-ooxml/tests/conformance_xlsx_round_trip.rs
new file mode 100644
index 00000000..4ef4e3e7
--- /dev/null
+++ b/loki-ooxml/tests/conformance_xlsx_round_trip.rs
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Spec 02 round-trip axis — XLSX **import-export-import** stability.
+//!
+//! The spreadsheet analogue of `conformance_round_trip.rs`: both compared
+//! workbooks are *imported*, so any divergence is a genuine export→re-import
+//! loss, reported with a `sheet0000/r0001c0002/…` model path by
+//! `appthere_conformance::sheet` rather than a bespoke per-cell assertion.
+
+#![cfg(feature = "xlsx")]
+
+use std::io::Cursor;
+
+use appthere_conformance::roundtrip::{Divergence, first_divergence};
+use appthere_conformance::sheet::canonicalize_workbook;
+use loki_ooxml::xlsx::export::XlsxExport;
+use loki_ooxml::xlsx::import::{XlsxImport, XlsxImportOptions};
+use loki_sheet_model::{CellStyle, NumberFormat, Workbook, Worksheet};
+
+fn import(bytes: Vec<u8>) -> Workbook {
+    XlsxImport::import(Cursor::new(bytes), XlsxImportOptions::default())
+        .expect("XLSX should import")
+}
+
+fn export(wb: &Workbook) -> Vec<u8> {
+    let mut buf = Cursor::new(Vec::new());
+    XlsxExport::export(wb, &mut buf).expect("XLSX export should succeed");
+    buf.into_inner()
+}
+
+/// First divergence of `seed` under XLSX import-export-import.
+fn round_trip_divergence(seed: &Workbook) -> Option<Divergence> {
+    let a = import(export(seed));
+    let b = import(export(&a));
+    first_divergence(&canonicalize_workbook(&a), &canonicalize_workbook(&b))
+}
+
+/// A workbook with values, a formula, a styled cell, and a custom column width
+/// must survive an XLSX export→re-import with no model divergence.
+#[test]
+fn xlsx_round_trip_preserves_core_content() {
+    let mut sheet = Worksheet::new("Data");
+    sheet.get_cell_mut(0, 0).value = "Item".to_string();
+    sheet.get_cell_mut(0, 1).value = "Qty".to_string();
+    sheet.get_cell_mut(1, 0).value = "Widgets".to_string();
+    sheet.get_cell_mut(1, 1).value = "42".to_string();
+    let total = sheet.get_cell_mut(2, 1);
+    total.value = "42".to_string();
+    total.formula = Some("=SUM(B2:B2)".to_string());
+
+    // A bold, percent-formatted header cell.
+    sheet.get_cell_mut(0, 0).style = Some(CellStyle {
+        bold: true,
+        num_format: NumberFormat::Percent,
+        ..Default::default()
+    });
+    sheet.set_column_width(0, 120.0);
+
+    let mut seed = Workbook::new();
+    seed.sheets = vec![sheet];
+
+    if let Some(d) = round_trip_divergence(&seed) {
+        panic!(
+            "core XLSX round-trip diverged at `{}`:\n  first import: {:?}\n  re-import:    {:?}",
+            d.path, d.left, d.right
+        );
+    }
+}
diff --git a/loki-ooxml/tests/math_round_trip.rs b/loki-ooxml/tests/math_round_trip.rs
index 97f819a3..39fe8d5d 100644
--- a/loki-ooxml/tests/math_round_trip.rs
+++ b/loki-ooxml/tests/math_round_trip.rs
@@ -6,6 +6,8 @@
 
 use std::io::Cursor;
 
+use appthere_conformance::model::canonicalize_document;
+use appthere_conformance::roundtrip::first_divergence;
 use loki_doc_model::content::block::Block;
 use loki_doc_model::content::inline::{Inline, MathType};
 use loki_doc_model::document::Document;
@@ -41,7 +43,7 @@ fn first_math(doc: &Document) -> Option<(MathType, String)> {
     None
 }
 
-fn round_trip(doc: &Document) -> Document {
+fn export_import(doc: &Document) -> Document {
     let mut buf = Cursor::new(Vec::new());
     DocxExport::export(doc, &mut buf, ()).expect("export should succeed");
     DocxImporter::new(DocxImportOptions::default())
@@ -50,6 +52,21 @@ fn round_trip(doc: &Document) -> Document {
         .document
 }
 
+/// One export→re-import cycle, **plus** a whole-model differ backstop: a second
+/// cycle must introduce no divergence, so any loss outside the `first_math`
+/// assertions below still fails with a model path (Spec 02 round-trip axis).
+fn round_trip(doc: &Document) -> Document {
+    let a = export_import(doc);
+    let b = export_import(&a);
+    if let Some(d) = first_divergence(&canonicalize_document(&a), &canonicalize_document(&b)) {
+        panic!(
+            "math round-trip diverged at `{}`:\n  {:?}\n  {:?}",
+            d.path, d.left, d.right
+        );
+    }
+    a
+}
+
 #[test]
 fn inline_fraction_round_trips() {
     let mathml = format!("<math xmlns=\"{NS}\"><mfrac><mn>1</mn><mn>2</mn></mfrac></math>");
diff --git a/loki-ooxml/tests/metadata_round_trip.rs b/loki-ooxml/tests/metadata_round_trip.rs
index a5938291..b0fd7535 100644
--- a/loki-ooxml/tests/metadata_round_trip.rs
+++ b/loki-ooxml/tests/metadata_round_trip.rs
@@ -6,6 +6,8 @@
 
 use std::io::Cursor;
 
+use appthere_conformance::model::canonicalize_document;
+use appthere_conformance::roundtrip::first_divergence;
 use loki_doc_model::content::block::Block;
 use loki_doc_model::content::inline::Inline;
 use loki_doc_model::document::Document;
@@ -23,7 +25,7 @@ fn doc_with_meta(meta: DocumentMeta) -> Document {
     doc
 }
 
-fn round_trip(doc: &Document) -> Document {
+fn export_import(doc: &Document) -> Document {
     let mut buf = Cursor::new(Vec::new());
     DocxExport::export(doc, &mut buf, ()).expect("export should succeed");
     DocxImporter::new(DocxImportOptions::default())
@@ -32,6 +34,22 @@ fn round_trip(doc: &Document) -> Document {
         .document
 }
 
+/// One export→re-import cycle, **plus** a whole-model differ backstop: a second
+/// cycle must introduce no divergence (Spec 02 round-trip axis). This folds the
+/// per-field assertions below into the normalized differ, so any metadata loss
+/// the asserts do not explicitly check still fails with a model path.
+fn round_trip(doc: &Document) -> Document {
+    let a = export_import(doc);
+    let b = export_import(&a);
+    if let Some(d) = first_divergence(&canonicalize_document(&a), &canonicalize_document(&b)) {
+        panic!(
+            "metadata round-trip diverged at `{}`:\n  {:?}\n  {:?}",
+            d.path, d.left, d.right
+        );
+    }
+    a
+}
+
 #[test]
 fn core_metadata_round_trips() {
     let meta = DocumentMeta {
diff --git a/loki-opc/LICENSE b/loki-opc/LICENSE
new file mode 100644
index 00000000..0b8ebc36
--- /dev/null
+++ b/loki-opc/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AppThere Loki contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/loki-opc/src/compat/content_types.rs b/loki-opc/src/compat/content_types.rs
index d7ef4628..d2cfe922 100644
--- a/loki-opc/src/compat/content_types.rs
+++ b/loki-opc/src/compat/content_types.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Content-types compatibility shims: fallback media types for unmapped
 //! extensions and locating a `[Content_Types].xml` part that some writers place
diff --git a/loki-opc/src/compat/mod.rs b/loki-opc/src/compat/mod.rs
index 58b2d7b9..efc465d5 100644
--- a/loki-opc/src/compat/mod.rs
+++ b/loki-opc/src/compat/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Compatibility shims for non-conformant OPC packages produced by real-world
 //! OOXML writers ([MS-OI29500] / [MS-OE376]).
diff --git a/loki-opc/src/compat/part_names.rs b/loki-opc/src/compat/part_names.rs
index 098e1567..8963dfea 100644
--- a/loki-opc/src/compat/part_names.rs
+++ b/loki-opc/src/compat/part_names.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Part-name compatibility shims: re-canonicalise non-standard percent encoding
 //! and resolve case-insensitive duplicate part names ([MS-OI29500] /
diff --git a/loki-opc/src/compat/relationships.rs b/loki-opc/src/compat/relationships.rs
index 87ee6e42..75c15255 100644
--- a/loki-opc/src/compat/relationships.rs
+++ b/loki-opc/src/compat/relationships.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Relationship-part compatibility notes ([MS-OI29500] / [MS-OE376]).
 
diff --git a/loki-opc/src/compat/zip_names.rs b/loki-opc/src/compat/zip_names.rs
index d7de0414..a756f391 100644
--- a/loki-opc/src/compat/zip_names.rs
+++ b/loki-opc/src/compat/zip_names.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! ZIP path compatibility shim: rewrite backslash separators emitted by
 //! non-conformant writers to forward slashes ([MS-OI29500] / [MS-OE376]).
diff --git a/loki-opc/src/constants.rs b/loki-opc/src/constants.rs
index 672af090..b2e4ce3b 100644
--- a/loki-opc/src/constants.rs
+++ b/loki-opc/src/constants.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Well-known OPC namespace URIs, relationship types, and media types
 //! (ISO/IEC 29500-2:2021).
diff --git a/loki-opc/src/content_types/mod.rs b/loki-opc/src/content_types/mod.rs
index 613ec27a..45261f61 100644
--- a/loki-opc/src/content_types/mod.rs
+++ b/loki-opc/src/content_types/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! The `[Content_Types].xml` model: per-extension default media types plus
 //! per-part overrides, with override taking precedence on lookup.
diff --git a/loki-opc/src/content_types/parse.rs b/loki-opc/src/content_types/parse.rs
index 73547bfb..19fc2ec2 100644
--- a/loki-opc/src/content_types/parse.rs
+++ b/loki-opc/src/content_types/parse.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Parses `[Content_Types].xml` into a [`ContentTypeMap`].
 
diff --git a/loki-opc/src/content_types/write.rs b/loki-opc/src/content_types/write.rs
index 50915ea4..2c2c072b 100644
--- a/loki-opc/src/content_types/write.rs
+++ b/loki-opc/src/content_types/write.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Serialises a [`ContentTypeMap`] to the `[Content_Types].xml` part.
 
diff --git a/loki-opc/src/core_properties/mod.rs b/loki-opc/src/core_properties/mod.rs
index ea48f68a..86b2949c 100644
--- a/loki-opc/src/core_properties/mod.rs
+++ b/loki-opc/src/core_properties/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! OPC core properties (`/docProps/core.xml`) — Dublin Core document metadata
 //! such as title, creator, and the created/modified timestamps. Parsing and
diff --git a/loki-opc/src/core_properties/parse.rs b/loki-opc/src/core_properties/parse.rs
index 6ac875aa..41e144cc 100644
--- a/loki-opc/src/core_properties/parse.rs
+++ b/loki-opc/src/core_properties/parse.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Deserialises the core-properties XML part via serde-derived structs.olating bounds dynamically loading properties efficiently.
 
diff --git a/loki-opc/src/core_properties/write.rs b/loki-opc/src/core_properties/write.rs
index 74a99eaa..38ff1add 100644
--- a/loki-opc/src/core_properties/write.rs
+++ b/loki-opc/src/core_properties/write.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Serialises [`CoreProperties`] to the `/docProps/core.xml` part, emitting the
 //! `cp`/`dc`/`dcterms`/`dcmitype`/`xsi` namespaces and W3CDTF-typed date
diff --git a/loki-opc/src/error.rs b/loki-opc/src/error.rs
index a4d97ec5..14f5af27 100644
--- a/loki-opc/src/error.rs
+++ b/loki-opc/src/error.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Errors generated during OPC extraction, parsing, and serialization.
 
diff --git a/loki-opc/src/lib.rs b/loki-opc/src/lib.rs
index 0ba24d78..2a90fcc7 100644
--- a/loki-opc/src/lib.rs
+++ b/loki-opc/src/lib.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Open Packaging Conventions (ISO/IEC 29500-2:2021) container support.
 //!
diff --git a/loki-opc/src/package.rs b/loki-opc/src/package.rs
index c80c3034..3fbb01c8 100644
--- a/loki-opc/src/package.rs
+++ b/loki-opc/src/package.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Open Packaging Conventions (ISO/IEC 29500-2:2021) primary root struct definitions.
 
@@ -168,10 +168,8 @@ impl Package {
 
     /// Mutable core properties. Creates the part and relationship if absent.
     pub fn core_properties_mut(&mut self) -> &mut CoreProperties {
-        if self.core_properties.is_none() {
-            self.core_properties = Some(CoreProperties::default());
-        }
-        self.core_properties.as_mut().unwrap()
+        self.core_properties
+            .get_or_insert_with(CoreProperties::default)
     }
 
     // --- Thumbnails ---
diff --git a/loki-opc/src/part/addressing.rs b/loki-opc/src/part/addressing.rs
index 55eaa0c8..16fbfbbb 100644
--- a/loki-opc/src/part/addressing.rs
+++ b/loki-opc/src/part/addressing.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Resolves relationship target references against a base part name (§8.3).
 
diff --git a/loki-opc/src/part/mod.rs b/loki-opc/src/part/mod.rs
index 3e9323fe..528a62df 100644
--- a/loki-opc/src/part/mod.rs
+++ b/loki-opc/src/part/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! OPC parts: validated [`PartName`]s and relationship-target addressing.
 
diff --git a/loki-opc/src/part/name.rs b/loki-opc/src/part/name.rs
index 27c0bd27..2f5d5fa3 100644
--- a/loki-opc/src/part/name.rs
+++ b/loki-opc/src/part/name.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Validated OPC part names: parsing and the grammar rules from §6.2.2.
 
@@ -75,7 +75,7 @@ impl PartName {
             }
         }
 
-        Self::new_unchecked(s)
+        Ok(Self::new_unchecked(s))
     }
 
     /// Wraps an already-validated string as a [`PartName`] without re-running
@@ -84,8 +84,8 @@ impl PartName {
     /// # Safety note
     /// Only for internal use where the name is known to be valid (e.g. ZIP
     /// entries already checked during read).
-    pub fn new_unchecked(s: String) -> OpcResult<Self> {
-        Ok(Self(s))
+    pub fn new_unchecked(s: String) -> Self {
+        Self(s)
     }
 
     /// Returns the string representation.
@@ -107,7 +107,7 @@ impl PartName {
             None => ("", name_str),
         };
         // Unchecked is safe because the parent part was already validated.
-        Self::new_unchecked(format!("{}/_rels/{}.rels", dir, filename)).unwrap()
+        Self::new_unchecked(format!("{}/_rels/{}.rels", dir, filename))
     }
 }
 
diff --git a/loki-opc/src/relationships/location.rs b/loki-opc/src/relationships/location.rs
index a608b8e0..ada306a5 100644
--- a/loki-opc/src/relationships/location.rs
+++ b/loki-opc/src/relationships/location.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Computes the conventional `.rels` part name for a given part (§6.5.1).
 
@@ -14,10 +14,10 @@ pub fn relationships_part_for(part: &PartName) -> PartName {
         None => ("", name_str),
     };
     // Format: directory/_rels/filename.rels
-    PartName::new_unchecked(format!("{}/_rels/{}.rels", dir, filename)).unwrap()
+    PartName::new_unchecked(format!("{}/_rels/{}.rels", dir, filename))
 }
 
 /// Returns the package-level relationships part name (`/_rels/.rels`).
 pub fn package_relationships_part() -> PartName {
-    PartName::new_unchecked("/_rels/.rels".to_string()).unwrap()
+    PartName::new_unchecked("/_rels/.rels".to_string())
 }
diff --git a/loki-opc/src/relationships/mod.rs b/loki-opc/src/relationships/mod.rs
index 065d2794..b2b7b14c 100644
--- a/loki-opc/src/relationships/mod.rs
+++ b/loki-opc/src/relationships/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! OPC relationships: the `Relationship`/`RelationshipSet` model plus parsing
 //! and writing of `.rels` parts and resolution of relationship targets.
diff --git a/loki-opc/src/relationships/parse.rs b/loki-opc/src/relationships/parse.rs
index adb0f709..a7c145fb 100644
--- a/loki-opc/src/relationships/parse.rs
+++ b/loki-opc/src/relationships/parse.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Parses a `.rels` part into `Relationship` records using `quick-xml`'s
 //! event-mode reader.
diff --git a/loki-opc/src/relationships/write.rs b/loki-opc/src/relationships/write.rs
index a856e1db..e5aa0ce4 100644
--- a/loki-opc/src/relationships/write.rs
+++ b/loki-opc/src/relationships/write.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Serialises a [`RelationshipSet`] to a `.rels` part.
 
diff --git a/loki-opc/src/zip/limits.rs b/loki-opc/src/zip/limits.rs
index 373716c5..4d7b09ef 100644
--- a/loki-opc/src/zip/limits.rs
+++ b/loki-opc/src/zip/limits.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Decompression budgets guarding package reads against ZIP bombs.
 //!
diff --git a/loki-opc/src/zip/mod.rs b/loki-opc/src/zip/mod.rs
index f9d5c3f3..d180e00c 100644
--- a/loki-opc/src/zip/mod.rs
+++ b/loki-opc/src/zip/mod.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! ZIP container I/O for OPC packages.
 //!
diff --git a/loki-opc/src/zip/read.rs b/loki-opc/src/zip/read.rs
index 26adcc24..a2d6aa87 100644
--- a/loki-opc/src/zip/read.rs
+++ b/loki-opc/src/zip/read.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Reads an OPC package from a ZIP archive.
 //!
@@ -115,13 +115,12 @@ pub fn read_package_from_zip<R: Read + Seek>(reader: &mut R) -> OpcResult<Packag
                 *pkg.relationships_mut() = rel_set;
             } else {
                 let (dir, file) = match name.as_str().rsplit_once("/_rels/") {
-                    Some((d, f)) => {
-                        if d.is_empty() {
-                            ("".to_string(), f.strip_suffix(".rels").unwrap().to_string())
-                        } else {
-                            (d.to_string(), f.strip_suffix(".rels").unwrap().to_string())
-                        }
-                    }
+                    // `name` ends with ".rels" (guarded above), so `f` does too;
+                    // `unwrap_or` keeps the gate panic-free regardless.
+                    Some((d, f)) => (
+                        d.to_string(),
+                        f.strip_suffix(".rels").unwrap_or(f).to_string(),
+                    ),
                     None => continue,
                 };
 
diff --git a/loki-opc/src/zip/write.rs b/loki-opc/src/zip/write.rs
index 19bcdc2e..07f3c988 100644
--- a/loki-opc/src/zip/write.rs
+++ b/loki-opc/src/zip/write.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Writes an OPC package to a ZIP archive.
 //!
diff --git a/loki-opc/tests/api_tests.rs b/loki-opc/tests/api_tests.rs
index 1448079c..c8f6aeec 100644
--- a/loki-opc/tests/api_tests.rs
+++ b/loki-opc/tests/api_tests.rs
@@ -1,5 +1,5 @@
-// Copyright 2026 AppThere Loki contributors
 // SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
 
 //! Public-API tests for `loki-opc`: part names, content types, relationships,
 //! the compatibility shims, target-reference resolution, and a full package
diff --git a/loki-opc/tests/package_tests.rs b/loki-opc/tests/package_tests.rs
index 4adaf720..5a996187 100644
--- a/loki-opc/tests/package_tests.rs
+++ b/loki-opc/tests/package_tests.rs
@@ -1,3 +1,6 @@
+// SPDX-License-Identifier: MIT
+// Copyright 2026 AppThere Loki contributors
+
 use loki_opc::Package;
 use loki_opc::PartData;
 use loki_opc::PartName;
diff --git a/loki-pdf/src/page.rs b/loki-pdf/src/page.rs
index f660c3c1..8e9fc502 100644
--- a/loki-pdf/src/page.rs
+++ b/loki-pdf/src/page.rs
@@ -214,109 +214,5 @@ fn render_border(
 }
 
 #[cfg(test)]
-mod tests {
-    use super::*;
-    use loki_layout::{GlyphSynthesis, LayoutColor, LayoutPoint};
-    use std::sync::Arc;
-
-    fn run_with(ids: &[u16]) -> PositionedGlyphRun {
-        PositionedGlyphRun {
-            origin: LayoutPoint { x: 0.0, y: 0.0 },
-            font_data: Arc::new(vec![0u8; 4]),
-            font_index: 0,
-            font_size: 12.0,
-            glyphs: ids
-                .iter()
-                .map(|&id| GlyphEntry {
-                    id,
-                    x: 0.0,
-                    y: 0.0,
-                    advance: 6.0,
-                })
-                .collect(),
-            color: LayoutColor::new(0.0, 0.0, 0.0, 1.0),
-            synthesis: GlyphSynthesis::default(),
-            link_url: None,
-        }
-    }
-
-    // A run made only of .notdef (id 0) glyphs — e.g. the glyph Parley shapes
-    // for a tab character — must not register a face or emit any glyph, matching
-    // the on-screen `loki-vello` renderer. Previously these rendered as tofu.
-    #[test]
-    fn notdef_only_run_emits_nothing() {
-        let mut bank = FontBank::new();
-        let mut content = Content::new();
-        render_run(&run_with(&[0, 0]), 100.0, 0.0, 0.0, &mut bank, &mut content);
-        assert!(
-            bank.is_empty(),
-            "a .notdef-only run must not register a face"
-        );
-    }
-
-    // A ClippedGroup must emit the PDF clip operators (`re` rect, `W` clip,
-    // `n` end-path) wrapped in save/restore, so table cell content is masked to
-    // the cell box rather than over-painting neighbours.
-    #[test]
-    fn clipped_group_emits_clip_operators() {
-        use loki_layout::{LayoutRect, LayoutSize, PositionedRect};
-        let mut fonts = FontBank::new();
-        let mut images = ImageBank::new();
-        let mut banks = PageBanks {
-            fonts: &mut fonts,
-            images: &mut images,
-        };
-        let mut content = Content::new();
-        let child = PositionedItem::FilledRect(PositionedRect {
-            rect: LayoutRect {
-                origin: LayoutPoint { x: 10.0, y: 10.0 },
-                size: LayoutSize {
-                    width: 5.0,
-                    height: 5.0,
-                },
-            },
-            color: LayoutColor::new(0.0, 0.0, 0.0, 1.0),
-        });
-        let group = PositionedItem::ClippedGroup {
-            clip_rect: LayoutRect {
-                origin: LayoutPoint { x: 0.0, y: 0.0 },
-                size: LayoutSize {
-                    width: 20.0,
-                    height: 20.0,
-                },
-            },
-            items: vec![child],
-        };
-        render_item(&group, 100.0, 0.0, 0.0, &mut banks, &mut content);
-        let bytes = content.finish().to_vec();
-        let stream = String::from_utf8_lossy(&bytes);
-        // `re` (rect) + `W` (clip-nonzero) + `n` (end-path) define the clip path;
-        // `q`/`Q` bracket it so the clip is popped after the children paint.
-        assert!(stream.contains("re"), "clip rect operator `re` missing");
-        assert!(stream.contains('W'), "clip operator `W` missing");
-        assert!(
-            stream.contains('q') && stream.contains('Q'),
-            "save/restore (`q`/`Q`) missing"
-        );
-    }
-
-    // A run mixing .notdef with real glyphs registers the face but excludes the
-    // .notdef id from the subset (and never draws it).
-    #[test]
-    fn notdef_is_filtered_from_real_run() {
-        let mut bank = FontBank::new();
-        let mut content = Content::new();
-        render_run(
-            &run_with(&[0, 5, 0, 7]),
-            100.0,
-            0.0,
-            0.0,
-            &mut bank,
-            &mut content,
-        );
-        assert_eq!(bank.faces().len(), 1);
-        let ids = bank.used_glyph_ids(0);
-        assert!(!ids.contains(&0), "the .notdef glyph must be filtered out");
-        assert!(ids.contains(&5) && ids.contains(&7), "real glyphs kept");
-    }
-}
+#[path = "page_tests.rs"]
+mod tests;
diff --git a/loki-pdf/src/page_tests.rs b/loki-pdf/src/page_tests.rs
new file mode 100644
index 00000000..2a5eb61e
--- /dev/null
+++ b/loki-pdf/src/page_tests.rs
@@ -0,0 +1,107 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use super::*;
+use loki_layout::{GlyphSynthesis, LayoutColor, LayoutPoint};
+use std::sync::Arc;
+
+fn run_with(ids: &[u16]) -> PositionedGlyphRun {
+    PositionedGlyphRun {
+        origin: LayoutPoint { x: 0.0, y: 0.0 },
+        font_data: Arc::new(vec![0u8; 4]),
+        font_index: 0,
+        font_size: 12.0,
+        glyphs: ids
+            .iter()
+            .map(|&id| GlyphEntry {
+                id,
+                x: 0.0,
+                y: 0.0,
+                advance: 6.0,
+            })
+            .collect(),
+        color: LayoutColor::new(0.0, 0.0, 0.0, 1.0),
+        synthesis: GlyphSynthesis::default(),
+        link_url: None,
+    }
+}
+
+// A run made only of .notdef (id 0) glyphs — e.g. the glyph Parley shapes
+// for a tab character — must not register a face or emit any glyph, matching
+// the on-screen `loki-vello` renderer. Previously these rendered as tofu.
+#[test]
+fn notdef_only_run_emits_nothing() {
+    let mut bank = FontBank::new();
+    let mut content = Content::new();
+    render_run(&run_with(&[0, 0]), 100.0, 0.0, 0.0, &mut bank, &mut content);
+    assert!(
+        bank.is_empty(),
+        "a .notdef-only run must not register a face"
+    );
+}
+
+// A ClippedGroup must emit the PDF clip operators (`re` rect, `W` clip,
+// `n` end-path) wrapped in save/restore, so table cell content is masked to
+// the cell box rather than over-painting neighbours.
+#[test]
+fn clipped_group_emits_clip_operators() {
+    use loki_layout::{LayoutRect, LayoutSize, PositionedRect};
+    let mut fonts = FontBank::new();
+    let mut images = ImageBank::new();
+    let mut banks = PageBanks {
+        fonts: &mut fonts,
+        images: &mut images,
+    };
+    let mut content = Content::new();
+    let child = PositionedItem::FilledRect(PositionedRect {
+        rect: LayoutRect {
+            origin: LayoutPoint { x: 10.0, y: 10.0 },
+            size: LayoutSize {
+                width: 5.0,
+                height: 5.0,
+            },
+        },
+        color: LayoutColor::new(0.0, 0.0, 0.0, 1.0),
+    });
+    let group = PositionedItem::ClippedGroup {
+        clip_rect: LayoutRect {
+            origin: LayoutPoint { x: 0.0, y: 0.0 },
+            size: LayoutSize {
+                width: 20.0,
+                height: 20.0,
+            },
+        },
+        items: vec![child],
+    };
+    render_item(&group, 100.0, 0.0, 0.0, &mut banks, &mut content);
+    let bytes = content.finish().to_vec();
+    let stream = String::from_utf8_lossy(&bytes);
+    // `re` (rect) + `W` (clip-nonzero) + `n` (end-path) define the clip path;
+    // `q`/`Q` bracket it so the clip is popped after the children paint.
+    assert!(stream.contains("re"), "clip rect operator `re` missing");
+    assert!(stream.contains('W'), "clip operator `W` missing");
+    assert!(
+        stream.contains('q') && stream.contains('Q'),
+        "save/restore (`q`/`Q`) missing"
+    );
+}
+
+// A run mixing .notdef with real glyphs registers the face but excludes the
+// .notdef id from the subset (and never draws it).
+#[test]
+fn notdef_is_filtered_from_real_run() {
+    let mut bank = FontBank::new();
+    let mut content = Content::new();
+    render_run(
+        &run_with(&[0, 5, 0, 7]),
+        100.0,
+        0.0,
+        0.0,
+        &mut bank,
+        &mut content,
+    );
+    assert_eq!(bank.faces().len(), 1);
+    let ids = bank.used_glyph_ids(0);
+    assert!(!ids.contains(&0), "the .notdef glyph must be filtered out");
+    assert!(ids.contains(&5) && ids.contains(&7), "real glyphs kept");
+}
diff --git a/loki-presentation/build.rs b/loki-presentation/build.rs
index 70f8872e..466ad05c 100644
--- a/loki-presentation/build.rs
+++ b/loki-presentation/build.rs
@@ -4,6 +4,10 @@
 //!
 //! Creates a symlink or copies `assets/` to target build profile directory.
 
+// Build script, not library runtime: a panic fails the build, which is the
+// intended behaviour for a missing `OUT_DIR`/`CARGO_MANIFEST_DIR`.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use std::env;
 #[cfg(not(unix))]
 use std::fs;
diff --git a/loki-presentation/src/lib.rs b/loki-presentation/src/lib.rs
index 938eeb41..8f758742 100644
--- a/loki-presentation/src/lib.rs
+++ b/loki-presentation/src/lib.rs
@@ -3,6 +3,11 @@
 
 //! `loki-presentation` library — Dioxus Native presentation components and routing.
 
+// The only `unsafe` in this binary is the Android FFI entry point, generated by
+// `loki_app_shell::android_main!` with its own scoped `#[allow(unsafe_code)]`
+// (Spec 01 audit A-7). Everything else is `deny`-clean.
+#![deny(unsafe_code)]
+
 pub mod app;
 pub mod error;
 pub mod new_document;
@@ -11,65 +16,11 @@ pub mod routes;
 pub mod tabs;
 pub mod utils;
 
-#[cfg(target_os = "android")]
-// COMPAT(android-16): On Android 16 (API 36) ANativeActivity_onCreate fires
-// twice in rapid succession, spawning two concurrent android_main threads.
-// A Mutex<bool> "is-running" flag rejects concurrent duplicates while allowing
-// sequential re-entries after activity-recreation (process reuse).
-static ANDROID_MAIN_RUNNING: std::sync::Mutex<bool> = std::sync::Mutex::new(false);
-
-#[cfg(target_os = "android")]
-#[unsafe(no_mangle)]
-fn android_main(android_app: android_activity::AndroidApp) {
-    {
-        let mut running = ANDROID_MAIN_RUNNING
-            .lock()
-            .unwrap_or_else(|p| p.into_inner());
-        if *running {
-            return;
-        }
-        *running = true;
-    }
-    android_logger::init_once(
-        android_logger::Config::default()
-            .with_tag("LOKI-PRESENT")
-            .with_max_level(log::LevelFilter::Debug),
-    );
-    // Route panic messages to logcat. The default panic hook writes to
-    // stderr, which Android discards — without this, any Rust panic (e.g.
-    // during GPU renderer init) is indistinguishable from a native crash.
-    std::panic::set_hook(Box::new(|info| {
-        log::error!("PANIC: {info}");
-    }));
-    log::info!("android_main: start");
-    // SAFETY: activity_as_ptr() is a GlobalRef owned by android_app, which
-    // blitz_shell::set_android_app keeps alive for the process lifetime.
-    unsafe { loki_file_access::init_android(android_app.activity_as_ptr()) };
-    let (top, bottom) = loki_file_access::query_insets_dp();
-    appthere_ui::set_safe_area_insets(appthere_ui::SafeAreaInsets {
-        top,
-        bottom,
-        ..Default::default()
-    });
-    if let Some(data_path) = android_app.internal_data_path() {
-        crate::recent_documents::set_android_data_dir(data_path);
-    }
-    blitz_shell::set_android_app(android_app);
-    log::info!("android_main: i18n init");
-    loki_i18n::init();
-    log::info!("android_main: launching dioxus");
-    // Pre-register bundled UI + metric fonts synchronously (see
-    // `loki_fonts::ui_font_blobs`) so the UI font resolves on Android without
-    // the asynchronous `@font-face` `data:` URI fetch.
-    dioxus::native::launch_cfg(
-        app::App,
-        vec![],
-        vec![Box::new(
-            dioxus::native::Config::new().with_fonts(loki_fonts::ui_font_blobs()),
-        )],
-    );
-    log::info!("android_main: dioxus exited");
-    *ANDROID_MAIN_RUNNING
-        .lock()
-        .unwrap_or_else(|p| p.into_inner()) = false;
-}
+// Android NativeActivity entry point. Shared body lives in
+// `loki_app_shell::android_main!` so the three suite binaries don't each carry a
+// copy (Spec 01 audit A-14).
+loki_app_shell::android_main!(
+    tag = "LOKI-PRESENT",
+    root = app::App,
+    file_access = activity_ptr
+);
diff --git a/loki-renderer/Cargo.toml b/loki-renderer/Cargo.toml
index cb9ccf82..d9337ebf 100644
--- a/loki-renderer/Cargo.toml
+++ b/loki-renderer/Cargo.toml
@@ -10,7 +10,6 @@ appthere-canvas   = { workspace = true }
 loki-doc-model    = { path = "../loki-doc-model" }
 loki-layout       = { path = "../loki-layout" }
 loki-vello        = { path = "../loki-vello" }
-appthere-ui       = { path = "../appthere-ui" }
 dioxus            = { version = "=0.7.9", features = ["native"] }
 # CustomPaintSource / CustomPaintCtx / TextureHandle / DeviceHandle for LokiPageSource.
 anyrender_vello   = "0.6.2"
diff --git a/loki-renderer/src/document_view.rs b/loki-renderer/src/document_view.rs
index 80ab844a..384704a0 100644
--- a/loki-renderer/src/document_view.rs
+++ b/loki-renderer/src/document_view.rs
@@ -6,7 +6,6 @@
 use std::sync::{Arc, Mutex};
 
 #[cfg(any(not(target_os = "android"), android_gpu))]
-use appthere_ui::tokens;
 use dioxus::prelude::*;
 use loki_doc_model::document::Document;
 use loki_layout::PaginatedLayout;
@@ -18,7 +17,7 @@ use loki_layout::PaginatedLayout;
 #[cfg(any(not(target_os = "android"), android_gpu))]
 use crate::page_tile::PageTile;
 #[cfg(any(not(target_os = "android"), android_gpu))]
-use crate::render_layout::RenderMode;
+use crate::render_layout::{PX_TO_PT, RenderMode, reflow_tile_width_px};
 use crate::renderer_state::RendererState;
 
 // The HTML-flow fallback is only used on the Android CPU path; GPU targets
@@ -130,6 +129,15 @@ pub struct DocumentViewProps {
     /// Called when a page tile is right-clicked (paginated mode), carrying the
     /// accurate tile-local + client coordinates. Drives the spelling context menu.
     pub on_tile_context: EventHandler<TileContext>,
+    /// Vertical gap between page tiles in paginated mode, in CSS px. Injected by
+    /// the app (from `appthere_ui::tokens::PAGE_GAP_PX`) rather than imported
+    /// here, so the render layer does not depend on the UI layer — Spec 01 audit
+    /// A-8. Zeroed automatically in reflow mode.
+    pub page_gap_px: f64,
+    /// Bottom padding below the last page, in CSS px (from
+    /// `appthere_ui::tokens::SPACE_6`). Injected for the same reason as
+    /// `page_gap_px`.
+    pub content_padding_bottom_px: f32,
 }
 
 impl PartialEq for DocumentViewProps {
@@ -185,7 +193,7 @@ pub fn DocumentView(props: DocumentViewProps) -> Element {
         // formatting fidelity), presented as zero-gap virtual tiles.
         let render_mode = if props.view_mode == ViewMode::Reflow && props.reflow_width_px > 1.0 {
             RenderMode::Reflow {
-                available_width_pt: (props.reflow_width_px * 72.0 / 96.0) as f32,
+                available_width_pt: reflow_tile_width_px(props.reflow_width_px as f32) * PX_TO_PT,
             }
         } else {
             RenderMode::Paginated
@@ -253,11 +261,7 @@ pub fn DocumentView(props: DocumentViewProps) -> Element {
                 focus,
             }
         });
-        let gap_px = if is_reflow {
-            0.0
-        } else {
-            tokens::PAGE_GAP_PX as f64
-        };
+        let gap_px = if is_reflow { 0.0 } else { props.page_gap_px };
         let on_tile_click = props.on_tile_click;
         let on_reflow_click = props.on_reflow_click;
         let on_reflow_drag = props.on_reflow_drag;
@@ -316,7 +320,7 @@ pub fn DocumentView(props: DocumentViewProps) -> Element {
                 div {
                     style: format!(
                         "position: relative; width: 100%; padding-bottom: {pb}px;{bg}",
-                        pb = tokens::SPACE_6,
+                        pb = props.content_padding_bottom_px,
                         bg = wrapper_bg,
                     ),
                     for (idx, w, h, visible) in tiles {
diff --git a/loki-renderer/src/page_tile.rs b/loki-renderer/src/page_tile.rs
index 5290f82d..08547f00 100644
--- a/loki-renderer/src/page_tile.rs
+++ b/loki-renderer/src/page_tile.rs
@@ -102,8 +102,10 @@ pub(crate) fn PageTile(props: PageTileProps) -> Element {
 
     rsx! {
         div {
-            // COMPAT(dioxus-native): position:absolute is unsupported in Blitz.
-            // Use block flow with auto margins for horizontal centring instead.
+            // Block flow with auto margins for horizontal centring. (Block-level
+            // position: absolute is now confirmed working in Blitz — CLAUDE.md
+            // "Confirmed CSS properties" — so this is a layout choice, not a
+            // Blitz limitation.)
             style: format!(
                 "display: block; width: {w}px; height: {h}px; \
                  margin-left: auto; margin-right: auto; \
diff --git a/loki-renderer/src/reflow_view.rs b/loki-renderer/src/reflow_view.rs
index 06904466..e4819eb0 100644
--- a/loki-renderer/src/reflow_view.rs
+++ b/loki-renderer/src/reflow_view.rs
@@ -171,9 +171,12 @@ pub(crate) fn ReflowDocView(props: ReflowDocViewProps) -> Element {
             // does not bleed through the reflowable content area.  max-width +
             // auto margins give a web-article reading measure on wide windows;
             // width:100% lets it shrink to fit narrow screens.
-            style: "font-family: 'Carlito', 'Arimo', sans-serif; padding: 16px; \
-                    box-sizing: border-box; color: #1a1a1a; width: 100%; \
-                    max-width: 820px; margin: 0 auto; background: #FAFAFA;",
+            style: format!(
+                "font-family: 'Carlito', 'Arimo', sans-serif; padding: 16px; \
+                 box-sizing: border-box; color: #1a1a1a; width: 100%; \
+                 max-width: {max}px; margin: 0 auto; background: #FAFAFA;",
+                max = crate::render_layout::MAX_REFLOW_TILE_PX,
+            ),
             for (inner_html, div_style) in &items {
                 div {
                     style: "{div_style}",
diff --git a/loki-renderer/src/render_layout.rs b/loki-renderer/src/render_layout.rs
index 4f66d18b..7bc1e474 100644
--- a/loki-renderer/src/render_layout.rs
+++ b/loki-renderer/src/render_layout.rs
@@ -34,6 +34,36 @@ pub const REFLOW_PADDING_PT: f32 = 18.0;
 /// measured.
 pub const MIN_REFLOW_CONTENT_PT: f32 = 50.0;
 
+/// Widest reflow **tile** (CSS px) — caps the reading measure so the
+/// non-paginated view holds a comfortable line length and **centres** on wide
+/// windows instead of running edge-to-edge (Spec 03 M4 / D5). Below this the
+/// tile tracks the viewport, so narrow screens use their full width. Matches the
+/// HTML reflow fallback's `max-width` so both reflow paths read identically.
+pub const MAX_REFLOW_TILE_PX: f32 = 820.0;
+
+/// CSS pixels → layout points (72 dpi / 96 dpi).
+pub const PX_TO_PT: f32 = 72.0 / 96.0;
+
+/// The reflow **tile** width (CSS px) for a measured viewport: the viewport
+/// width capped at [`MAX_REFLOW_TILE_PX`]. The renderer centres the tile
+/// (`margin: auto`), so capping it centres the reading column. The single source
+/// of reflow width for paint, hit-testing, and keyboard navigation — they must
+/// agree (Spec 01 A-1), so all derive from this.
+#[must_use]
+pub fn reflow_tile_width_px(viewport_width_px: f32) -> f32 {
+    viewport_width_px.clamp(0.0, MAX_REFLOW_TILE_PX)
+}
+
+/// The reflow **content** width (the reading measure, in points) for a measured
+/// viewport: the tile minus the [`REFLOW_PADDING_PT`] side insets, floored at
+/// [`MIN_REFLOW_CONTENT_PT`]. Hit-testing and keyboard navigation use this so
+/// they match what was painted.
+#[must_use]
+pub fn reflow_content_width_pt(viewport_width_px: f32) -> f32 {
+    (reflow_tile_width_px(viewport_width_px) * PX_TO_PT - 2.0 * REFLOW_PADDING_PT)
+        .max(MIN_REFLOW_CONTENT_PT)
+}
+
 // ── RenderMode ────────────────────────────────────────────────────────────────
 
 /// Which layout the renderer should produce.
diff --git a/loki-renderer/src/render_layout_tests.rs b/loki-renderer/src/render_layout_tests.rs
index 3f7c245c..e25569cb 100644
--- a/loki-renderer/src/render_layout_tests.rs
+++ b/loki-renderer/src/render_layout_tests.rs
@@ -82,6 +82,7 @@ fn one_para_reflow(text: &str, origin: (f32, f32)) -> RenderLayout {
             items: vec![],
             paragraphs: vec![PageParagraphData {
                 block_index: 3,
+                path: vec![],
                 layout: std::sync::Arc::new(para),
                 origin,
             }],
@@ -131,3 +132,36 @@ fn render_mode_width_tolerant_equality() {
     assert!(!a.matches(&c));
     assert!(!a.matches(&RenderMode::Paginated));
 }
+
+// ── Spec 03 M4: bounded reflow measure ──────────────────────────────────────
+
+#[test]
+fn narrow_viewport_uses_its_full_width() {
+    // Below the cap the tile tracks the viewport (phones use the whole screen).
+    assert_eq!(reflow_tile_width_px(375.0), 375.0);
+    assert_eq!(reflow_tile_width_px(600.0), 600.0);
+}
+
+#[test]
+fn wide_viewport_caps_the_measure_so_it_can_centre() {
+    // At and beyond the cap the tile stops growing — leaving room for the
+    // renderer's `margin: auto` to centre the reading column.
+    assert_eq!(reflow_tile_width_px(MAX_REFLOW_TILE_PX), MAX_REFLOW_TILE_PX);
+    assert_eq!(reflow_tile_width_px(2560.0), MAX_REFLOW_TILE_PX);
+    // The measure no longer grows with the window — the "cramped"/edge-to-edge
+    // bug (R-6) cannot recur on a wide window.
+    assert_eq!(
+        reflow_content_width_pt(1600.0),
+        reflow_content_width_pt(3000.0)
+    );
+}
+
+#[test]
+fn content_width_is_tile_minus_insets_and_floored() {
+    // Content = tile(px)·PX_TO_PT − 2·padding, in points.
+    let expect = MAX_REFLOW_TILE_PX * PX_TO_PT - 2.0 * REFLOW_PADDING_PT;
+    assert!((reflow_content_width_pt(2000.0) - expect).abs() < 1e-3);
+    // A degenerate (tiny) viewport floors at the engine minimum, never negative.
+    assert_eq!(reflow_content_width_pt(1.0), MIN_REFLOW_CONTENT_PT);
+    assert_eq!(reflow_content_width_pt(0.0), MIN_REFLOW_CONTENT_PT);
+}
diff --git a/loki-server/src/main.rs b/loki-server/src/main.rs
index e3f4aaa3..76c6c78a 100644
--- a/loki-server/src/main.rs
+++ b/loki-server/src/main.rs
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
+#![forbid(unsafe_code)]
+
 //! `loki-server` — the single modular Axum binary (ADR-C012): REST API,
 //! WebSocket collaboration relay, and OIDC auth in one artifact, scaled
 //! horizontally behind a load balancer or run alone on a small box.
diff --git a/loki-spreadsheet/build.rs b/loki-spreadsheet/build.rs
index a12d6855..9bc2502f 100644
--- a/loki-spreadsheet/build.rs
+++ b/loki-spreadsheet/build.rs
@@ -4,6 +4,10 @@
 //!
 //! Creates a symlink or copies `assets/` to target build profile directory.
 
+// Build script, not library runtime: a panic fails the build, which is the
+// intended behaviour for a missing `OUT_DIR`/`CARGO_MANIFEST_DIR`.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use std::env;
 #[cfg(not(unix))]
 use std::fs;
diff --git a/loki-spreadsheet/src/lib.rs b/loki-spreadsheet/src/lib.rs
index 76e1395e..0d22917b 100644
--- a/loki-spreadsheet/src/lib.rs
+++ b/loki-spreadsheet/src/lib.rs
@@ -8,6 +8,10 @@
 
 // Pre-existing pattern in routes/editor/editor_inner.rs — structural refactor deferred
 #![allow(clippy::manual_strip)]
+// The only `unsafe` in this binary is the Android FFI entry point, generated by
+// `loki_app_shell::android_main!` with its own scoped `#[allow(unsafe_code)]`
+// (Spec 01 audit A-7). Everything else is `deny`-clean.
+#![deny(unsafe_code)]
 
 pub mod app;
 pub mod error;
@@ -17,65 +21,11 @@ pub mod routes;
 pub mod tabs;
 pub mod utils;
 
-#[cfg(target_os = "android")]
-// COMPAT(android-16): On Android 16 (API 36) ANativeActivity_onCreate fires
-// twice in rapid succession, spawning two concurrent android_main threads.
-// A Mutex<bool> "is-running" flag rejects concurrent duplicates while allowing
-// sequential re-entries after activity-recreation (process reuse).
-static ANDROID_MAIN_RUNNING: std::sync::Mutex<bool> = std::sync::Mutex::new(false);
-
-#[cfg(target_os = "android")]
-#[unsafe(no_mangle)]
-fn android_main(android_app: android_activity::AndroidApp) {
-    {
-        let mut running = ANDROID_MAIN_RUNNING
-            .lock()
-            .unwrap_or_else(|p| p.into_inner());
-        if *running {
-            return;
-        }
-        *running = true;
-    }
-    android_logger::init_once(
-        android_logger::Config::default()
-            .with_tag("LOKI-SHEET")
-            .with_max_level(log::LevelFilter::Debug),
-    );
-    // Route panic messages to logcat. The default panic hook writes to
-    // stderr, which Android discards — without this, any Rust panic (e.g.
-    // during GPU renderer init) is indistinguishable from a native crash.
-    std::panic::set_hook(Box::new(|info| {
-        log::error!("PANIC: {info}");
-    }));
-    log::info!("android_main: start");
-    // SAFETY: activity_as_ptr() is a GlobalRef owned by android_app, which
-    // blitz_shell::set_android_app keeps alive for the process lifetime.
-    unsafe { loki_file_access::init_android(android_app.activity_as_ptr()) };
-    let (top, bottom) = loki_file_access::query_insets_dp();
-    appthere_ui::set_safe_area_insets(appthere_ui::SafeAreaInsets {
-        top,
-        bottom,
-        ..Default::default()
-    });
-    if let Some(data_path) = android_app.internal_data_path() {
-        crate::recent_documents::set_android_data_dir(data_path);
-    }
-    blitz_shell::set_android_app(android_app);
-    log::info!("android_main: i18n init");
-    loki_i18n::init();
-    log::info!("android_main: launching dioxus");
-    // Pre-register bundled UI + metric fonts synchronously (see
-    // `loki_fonts::ui_font_blobs`) so the UI font resolves on Android without
-    // the asynchronous `@font-face` `data:` URI fetch.
-    dioxus::native::launch_cfg(
-        app::App,
-        vec![],
-        vec![Box::new(
-            dioxus::native::Config::new().with_fonts(loki_fonts::ui_font_blobs()),
-        )],
-    );
-    log::info!("android_main: dioxus exited");
-    *ANDROID_MAIN_RUNNING
-        .lock()
-        .unwrap_or_else(|p| p.into_inner()) = false;
-}
+// Android NativeActivity entry point. Shared body lives in
+// `loki_app_shell::android_main!` so the three suite binaries don't each carry a
+// copy (Spec 01 audit A-14).
+loki_app_shell::android_main!(
+    tag = "LOKI-SHEET",
+    root = app::App,
+    file_access = activity_ptr
+);
diff --git a/loki-templates/src/bin/gen_templates.rs b/loki-templates/src/bin/gen_templates.rs
index 43f70009..dda90348 100644
--- a/loki-templates/src/bin/gen_templates.rs
+++ b/loki-templates/src/bin/gen_templates.rs
@@ -6,6 +6,10 @@
 //! Run with `cargo run -p loki-templates --bin gen_templates`. Writes one
 //! `assets/<id>.dotx` per entry in `loki_templates::TEMPLATES`.
 
+// Offline codegen tool, not library runtime: a panic aborts the regeneration
+// run (and is the desired failure mode), so unwrap/expect are fine here.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use std::io::Cursor;
 use std::path::Path;
 
diff --git a/loki-text/Cargo.toml b/loki-text/Cargo.toml
index 288ce8bc..4c1b277d 100644
--- a/loki-text/Cargo.toml
+++ b/loki-text/Cargo.toml
@@ -69,6 +69,10 @@ dirs = "6"
 # JSON serialisation for recent-documents file.
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+# Image decoding for Insert → Image (intrinsic pixel dimensions).
+image = "0.25"
+# Base64 encoding for embedding inserted images as data URIs.
+base64 = "0.22"
 # Fluent-based internationalisation for all user-visible strings.
 loki-i18n = { path = "../loki-i18n" }
 # Tiered-cache page renderer with DocumentView component.
diff --git a/loki-text/build.rs b/loki-text/build.rs
index 05f65f2f..5952a837 100644
--- a/loki-text/build.rs
+++ b/loki-text/build.rs
@@ -25,6 +25,10 @@
 //! expected to copy `loki-text/assets/` into the bundle's asset directory.
 //! The symlink is not needed in that case.
 
+// Build script, not library runtime: a panic fails the build, which is the
+// intended behaviour for a missing `OUT_DIR`/`CARGO_MANIFEST_DIR`.
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
 use std::env;
 #[cfg(not(unix))]
 use std::fs;
diff --git a/loki-text/src/app.rs b/loki-text/src/app.rs
index 58d0cda1..6002e1cf 100644
--- a/loki-text/src/app.rs
+++ b/loki-text/src/app.rs
@@ -18,7 +18,7 @@
 //! window vertically scrollable.
 
 use appthere_ui::tokens;
-use appthere_ui::{AtThemeContext, use_safe_area};
+use appthere_ui::{AtThemeContext, use_provide_responsive, use_safe_area};
 use dioxus::prelude::*;
 
 use crate::recent_documents::RecentDocuments;
@@ -94,6 +94,12 @@ pub fn App() -> Element {
     // Inject the theme context before any shell component renders.
     provide_context(AtThemeContext::default());
 
+    // Provide the shared responsive context (Spec 03 M1). Seeded unmeasured
+    // (→ Breakpoint::Compact); the editor funnels the one measured scroll-
+    // container width into it (no second width source). Descendants read the
+    // derived breakpoint via `appthere_ui::use_breakpoint`.
+    use_provide_responsive();
+
     // Spell-check service — starts on the bundled English dictionary so checking
     // works offline. Provided into context for any component (e.g. a future
     // language picker), and installed into the editor's ambient layout state so
diff --git a/loki-text/src/editing/cursor.rs b/loki-text/src/editing/cursor.rs
index 66abb64c..9c6600bb 100644
--- a/loki-text/src/editing/cursor.rs
+++ b/loki-text/src/editing/cursor.rs
@@ -3,15 +3,18 @@
 
 //! Cursor and selection state for the Loki document editor.
 
+use loki_doc_model::{BlockPath, PathStep};
 use unicode_segmentation::UnicodeSegmentation;
 
 /// A document position identified by page index, paragraph index within the
 /// page, and byte offset within the paragraph.
 ///
-/// All three fields are zero-based.  `paragraph_index` is an index into
-/// [`loki_layout::PageEditingData::paragraph_layouts`] for the given page.
-/// `byte_offset` is a byte offset into the paragraph's flattened text content.
-#[derive(Debug, Clone, PartialEq)]
+/// All three index fields are zero-based.  `paragraph_index` is an index into
+/// [`loki_layout::PageEditingData::paragraph_layouts`] for the given page (which
+/// is the document-global block index of the paragraph, or its **root** block
+/// when nested).  `byte_offset` is a byte offset into the paragraph's flattened
+/// text content.
+#[derive(Debug, Clone, PartialEq, Default)]
 pub struct DocumentPosition {
     /// Zero-based index of the page that contains this position.
     pub page_index: usize,
@@ -20,6 +23,55 @@ pub struct DocumentPosition {
     pub paragraph_index: usize,
     /// Byte offset into the paragraph's flattened text content.
     pub byte_offset: usize,
+    /// Descent into a nested container (table cell / note body). Empty for an
+    /// ordinary top-level paragraph. With `paragraph_index` as the root this
+    /// forms the [`BlockPath`] the editor uses to address the paragraph.
+    pub path: Vec<PathStep>,
+}
+
+impl DocumentPosition {
+    /// A top-level position (no nesting) — the common case.
+    #[must_use]
+    pub fn top_level(page_index: usize, paragraph_index: usize, byte_offset: usize) -> Self {
+        Self {
+            page_index,
+            paragraph_index,
+            byte_offset,
+            path: Vec::new(),
+        }
+    }
+
+    /// The [`BlockPath`] addressing this position's paragraph for mutation.
+    #[must_use]
+    pub fn block_path(&self) -> BlockPath {
+        BlockPath {
+            root: self.paragraph_index,
+            steps: self.path.clone(),
+        }
+    }
+
+    /// The position of a sibling block within the **same container**, shifted by
+    /// `delta` blocks, at `byte_offset`.
+    ///
+    /// For a top-level position this shifts `paragraph_index`; for a nested
+    /// position (inside a table cell / note body) it shifts the leaf
+    /// [`PathStep`]'s block index, leaving the root `paragraph_index` untouched.
+    /// Used to place the cursor after a paragraph split (`delta = 1`, offset 0)
+    /// or merge (`delta = -1`, offset = the join point).
+    #[must_use]
+    pub fn sibling_block(&self, delta: isize, byte_offset: usize) -> Self {
+        let mut pos = self.clone();
+        pos.byte_offset = byte_offset;
+        match pos.path.last_mut() {
+            Some(PathStep::Cell { block, .. } | PathStep::Note { block, .. }) => {
+                *block = block.saturating_add_signed(delta);
+            }
+            None => {
+                pos.paragraph_index = pos.paragraph_index.saturating_add_signed(delta);
+            }
+        }
+        pos
+    }
 }
 
 /// The current cursor and selection state for the editor.
@@ -78,6 +130,14 @@ impl CursorState {
     pub fn has_selection(&self) -> bool {
         self.anchor.is_some() && self.focus.is_some() && self.anchor != self.focus
     }
+
+    /// The [`BlockPath`] of the focus position, if a cursor is placed.
+    ///
+    /// `BlockPath::block(i)` for a top-level cursor; a nested path when the
+    /// focus is inside a table cell / note body.
+    pub fn block_path(&self) -> Option<BlockPath> {
+        self.focus.as_ref().map(DocumentPosition::block_path)
+    }
 }
 
 impl Default for CursorState {
@@ -174,4 +234,66 @@ mod tests {
         let s = "a\u{1F600}b";
         assert_eq!(next_grapheme_boundary(s, 1), 5);
     }
+
+    #[test]
+    fn top_level_position_block_path_is_flat() {
+        let pos = DocumentPosition::top_level(0, 3, 7);
+        assert_eq!(pos.block_path(), BlockPath::block(3));
+        assert!(pos.path.is_empty());
+    }
+
+    #[test]
+    fn nested_position_block_path_carries_steps() {
+        let pos = DocumentPosition {
+            page_index: 0,
+            paragraph_index: 2,
+            byte_offset: 0,
+            path: vec![PathStep::Cell { cell: 1, block: 0 }],
+        };
+        assert_eq!(pos.block_path(), BlockPath::in_cell(2, 1, 0));
+    }
+
+    #[test]
+    fn sibling_block_shifts_top_level_paragraph() {
+        let pos = DocumentPosition::top_level(0, 3, 7);
+        let next = pos.sibling_block(1, 0);
+        assert_eq!(next.paragraph_index, 4);
+        assert_eq!(next.byte_offset, 0);
+        assert!(next.path.is_empty());
+        // Saturates at 0 rather than underflowing.
+        assert_eq!(
+            DocumentPosition::top_level(0, 0, 0)
+                .sibling_block(-1, 5)
+                .paragraph_index,
+            0
+        );
+    }
+
+    #[test]
+    fn sibling_block_shifts_nested_leaf_block_only() {
+        let pos = DocumentPosition {
+            page_index: 0,
+            paragraph_index: 2,
+            byte_offset: 9,
+            path: vec![PathStep::Cell { cell: 1, block: 0 }],
+        };
+        let next = pos.sibling_block(1, 0);
+        // Root paragraph_index is untouched; the leaf block index advances.
+        assert_eq!(next.paragraph_index, 2);
+        assert_eq!(next.byte_offset, 0);
+        assert_eq!(next.path, vec![PathStep::Cell { cell: 1, block: 1 }]);
+    }
+
+    #[test]
+    fn cursor_block_path_follows_focus() {
+        let mut cs = CursorState::new();
+        assert_eq!(cs.block_path(), None);
+        cs.focus = Some(DocumentPosition {
+            page_index: 0,
+            paragraph_index: 5,
+            byte_offset: 0,
+            path: vec![PathStep::Note { note: 0, block: 0 }],
+        });
+        assert_eq!(cs.block_path(), Some(BlockPath::in_note(5, 0, 0)));
+    }
 }
diff --git a/loki-text/src/editing/hit_test.rs b/loki-text/src/editing/hit_test.rs
index 60d2b4bb..ce6bbb7d 100644
--- a/loki-text/src/editing/hit_test.rs
+++ b/loki-text/src/editing/hit_test.rs
@@ -13,9 +13,12 @@
 //! `ClientPoint` (window-relative logical pixels). The canvas origin
 //! is therefore computed from:
 //!
-//! - `canvas_origin.x` = `(window_inner_width_px − page_width_px) / 2.0`
-//!   (pages are flex-centered; `window_inner_width_px` defaults to 1280 px
-//!   and must be updated when a window-size API becomes available in Blitz).
+//! - `canvas_origin.x` = `(viewport_width_px − page_width_px) / 2.0` (pages are
+//!   flex-centered). `viewport_width_px` is the **measured** scroll-container
+//!   width (`scroll_metrics.client_width`), wrapped in
+//!   [`crate::editing::viewport::Viewport`] which owns this centring math — see
+//!   `Viewport::centred_origin_x`. (Previously a hardcoded 1280 px default;
+//!   Spec 01 audit A-1.)
 //! - `canvas_origin.y` = `TOOLBAR_HEIGHT_TOP + SPACE_6` (exact from tokens).
 //!
 //! - `scroll_offset` = 0.0 (Blitz does not expose `node.scroll_offset` to
@@ -187,375 +190,14 @@ pub fn hit_test_page(
         page_index,
         paragraph_index: para_data.block_index,
         byte_offset,
+        // Carry the nesting descent so a click inside a table cell / note body
+        // resolves to the right nested paragraph (empty for top-level).
+        path: para_data.path.clone(),
     })
 }
 
 // ── Tests ─────────────────────────────────────────────────────────────────────
 
 #[cfg(test)]
-mod tests {
-    use std::sync::Arc;
-
-    use loki_layout::{
-        FontResources, LayoutColor, LayoutInsets, LayoutPage, LayoutSize, PageEditingData,
-        PageParagraphData, PaginatedLayout, ResolvedParaProps, StyleSpan, layout_paragraph,
-    };
-
-    use super::*;
-
-    /// Build a minimal `PaginatedLayout` with a single page containing one
-    /// paragraph placed at the content-area origin.
-    fn make_test_layout() -> PaginatedLayout {
-        let mut resources = FontResources::new();
-        let para = layout_paragraph(
-            &mut resources,
-            "Hello world",
-            &[StyleSpan {
-                range: 0..11,
-                font_name: None,
-                font_size: 12.0,
-                bold: false,
-                weight: 400,
-                italic: false,
-                color: LayoutColor::BLACK,
-                underline: None,
-                strikethrough: None,
-                line_height: None,
-                vertical_align: None,
-                highlight_color: None,
-                letter_spacing: None,
-                font_variant: None,
-                word_spacing: None,
-                shadow: false,
-                link_url: None,
-                math: None,
-                scale: None,
-                baseline_shift: None,
-            }],
-            &ResolvedParaProps::default(),
-            400.0,
-            1.0,
-            true, // preserve_for_editing
-        );
-        let editing_data = PageEditingData {
-            paragraphs: vec![PageParagraphData {
-                block_index: 0,
-                layout: Arc::new(para),
-                origin: (0.0, 0.0),
-            }],
-        };
-        let page_size = LayoutSize::new(595.0, 842.0);
-        let margins = LayoutInsets {
-            top: 72.0,
-            right: 72.0,
-            bottom: 72.0,
-            left: 72.0,
-        };
-        let page = LayoutPage {
-            page_number: 1,
-            page_size,
-            margins,
-            content_items: vec![],
-            header_items: vec![],
-            footer_items: vec![],
-            comment_items: vec![],
-            header_height: 0.0,
-            footer_height: 0.0,
-            editing_data: Some(editing_data),
-        };
-        PaginatedLayout {
-            page_size,
-            pages: vec![Arc::new(page)],
-        }
-    }
-
-    /// Convert layout points to CSS pixels (inverse of PX_TO_PT).
-    fn pt_to_px(pt: f32) -> f32 {
-        pt * (96.0 / 72.0)
-    }
-
-    /// canvas_origin + margin offset in CSS pixels.
-    fn canvas_origin_for_test() -> (f32, f32) {
-        (0.0, 0.0)
-    }
-
-    #[test]
-    fn click_at_content_origin_returns_page0_para0_offset0() {
-        let layout = make_test_layout();
-        let page = &layout.pages[0];
-
-        // Click at the content area's (0, 0): canvas_x = margin_left, canvas_y = margin_top.
-        let page_w_px = pt_to_px(page.page_size.width);
-        let page_h_px = pt_to_px(page.page_size.height);
-        let margin_left_px = pt_to_px(page.margins.left);
-        let margin_top_px = pt_to_px(page.margins.top);
-
-        let result = hit_test_document(
-            margin_left_px, // client_x = canvas_x = margin_left in px
-            margin_top_px,  // client_y = canvas_y = margin_top in px
-            canvas_origin_for_test(),
-            0.0, // scroll_offset
-            &layout,
-            page_w_px,
-            page_h_px,
-            pt_to_px(24.0), // page_gap_px
-        );
-        let pos = result.expect("click at content origin should hit para 0");
-        assert_eq!(pos.page_index, 0);
-        assert_eq!(pos.paragraph_index, 0);
-        assert_eq!(pos.byte_offset, 0, "top-left click should land at byte 0");
-    }
-
-    #[test]
-    fn click_below_all_content_returns_none() {
-        let layout = make_test_layout();
-        let page = &layout.pages[0];
-        let page_h_px = pt_to_px(page.page_size.height);
-        let page_w_px = pt_to_px(page.page_size.width);
-
-        // Click far below the page canvas.
-        let result = hit_test_document(
-            page_w_px / 2.0,
-            page_h_px + 100.0, // in the inter-page gap
-            canvas_origin_for_test(),
-            0.0,
-            &layout,
-            page_w_px,
-            page_h_px,
-            pt_to_px(24.0),
-        );
-        assert!(
-            result.is_none(),
-            "click below page content area must return None"
-        );
-    }
-
-    #[test]
-    fn click_on_page2_returns_page_index_1() {
-        let layout = {
-            // Build a two-page layout by duplicating the single-page layout.
-            let single = make_test_layout();
-            let page0 = single.pages[0].clone();
-            let mut page1 = (*page0).clone();
-            page1.page_number = 2;
-            PaginatedLayout {
-                page_size: single.page_size,
-                pages: vec![page0, Arc::new(page1)],
-            }
-        };
-        let page_h_px = pt_to_px(layout.page_size.height);
-        let page_w_px = pt_to_px(layout.page_size.width);
-        let page_gap_px = pt_to_px(24.0);
-        let page = &layout.pages[1];
-        let margin_left_px = pt_to_px(page.margins.left);
-        // y at the content area of page 1 = page_height + gap + margin_top.
-        let page2_margin_top_px = pt_to_px(page.margins.top);
-        let click_y = page_h_px + page_gap_px + page2_margin_top_px;
-
-        let result = hit_test_document(
-            margin_left_px,
-            click_y,
-            canvas_origin_for_test(),
-            0.0,
-            &layout,
-            page_w_px,
-            page_h_px,
-            page_gap_px,
-        );
-        let pos = result.expect("click on page 2 should succeed");
-        assert_eq!(pos.page_index, 1, "should land on page 1 (0-based)");
-    }
-
-    /// Verifies that a negative canvas_y (which occurs when scroll_offset is not
-    /// subtracted from page_top_y in the click handler) causes hit_test_page to
-    /// return None.  This documents the root cause of the multi-page cursor bug
-    /// when scroll_offset is zero but the user has scrolled.
-    #[test]
-    fn hit_test_page_negative_y_returns_none() {
-        let layout = make_test_layout();
-        // y < 0 means the click is above the page canvas — should return None.
-        let result = hit_test_page(0, 100.0, -10.0, &layout);
-        assert!(result.is_none(), "negative y_in_page must return None");
-    }
-
-    /// Verifies that passing the correct scroll_offset to hit_test_document
-    /// allows a click on page 2 to be resolved when the user has scrolled.
-    ///
-    /// This tests the mathematical contract of the coordinate transform, not
-    /// Blitz scroll tracking (which is currently unimplemented — see
-    /// TODO(partial-render) in editor.rs).
-    #[test]
-    fn scroll_offset_corrects_page2_click() {
-        let layout = {
-            let single = make_test_layout();
-            let page0 = single.pages[0].clone();
-            let mut page1 = (*page0).clone();
-            page1.page_number = 2;
-            PaginatedLayout {
-                page_size: single.page_size,
-                pages: vec![page0, Arc::new(page1)],
-            }
-        };
-        let page = &layout.pages[0];
-        let page_h_px = pt_to_px(page.page_size.height);
-        let page_w_px = pt_to_px(page.page_size.width);
-        let page_gap_px = pt_to_px(24.0);
-        let margin_left_px = pt_to_px(page.margins.left);
-        let margin_top_px = pt_to_px(page.margins.top);
-
-        // User has scrolled so that page 2 is at the top of the viewport.
-        let scroll_offset = page_h_px + page_gap_px;
-
-        // With this scroll, a click at client_y = canvas_origin.y + margin_top
-        // should resolve to the top-left content area of page 2.
-        let canvas_origin = canvas_origin_for_test();
-        let click_y = canvas_origin.1 + margin_top_px;
-
-        let result = hit_test_document(
-            margin_left_px,
-            click_y,
-            canvas_origin,
-            scroll_offset,
-            &layout,
-            page_w_px,
-            page_h_px,
-            page_gap_px,
-        );
-        let pos = result.expect("correct scroll_offset must resolve page 2 click");
-        assert_eq!(
-            pos.page_index, 1,
-            "scroll-adjusted click must land on page 1 (0-based)"
-        );
-    }
-
-    /// Verifies that omitting scroll_offset (passing 0) for a click that should
-    /// land on page 2 returns None or lands on the wrong page — confirming that
-    /// scroll_offset is required for correct multi-page hit testing.
-    #[test]
-    fn missing_scroll_offset_misses_page2_click() {
-        let layout = {
-            let single = make_test_layout();
-            let page0 = single.pages[0].clone();
-            let mut page1 = (*page0).clone();
-            page1.page_number = 2;
-            PaginatedLayout {
-                page_size: single.page_size,
-                pages: vec![page0, Arc::new(page1)],
-            }
-        };
-        let page = &layout.pages[0];
-        let page_h_px = pt_to_px(page.page_size.height);
-        let page_w_px = pt_to_px(page.page_size.width);
-        let page_gap_px = pt_to_px(24.0);
-        let margin_left_px = pt_to_px(page.margins.left);
-        let margin_top_px = pt_to_px(page.margins.top);
-
-        // Same scenario as above but scroll_offset is incorrectly left as 0.
-        let canvas_origin = canvas_origin_for_test();
-        let click_y = canvas_origin.1 + margin_top_px; // top of viewport when scrolled to page 2
-
-        let result = hit_test_document(
-            margin_left_px,
-            click_y,
-            canvas_origin,
-            0.0, // wrong: no scroll_offset applied
-            &layout,
-            page_w_px,
-            page_h_px,
-            page_gap_px,
-        );
-        // Without scroll_offset, click_y maps to page 0 content (near top),
-        // so result is either page 0 or None — never page 1.
-        if let Some(pos) = result {
-            assert_ne!(
-                pos.page_index, 1,
-                "without scroll_offset, click must not reach page 1"
-            );
-        }
-    }
-
-    // ── Reflow (continuous) hit-testing ───────────────────────────────────────
-
-    /// One reflow paragraph laid out at the given canvas origin.
-    fn reflow_para(text: &str, block_index: usize, origin: (f32, f32)) -> PageParagraphData {
-        let mut resources = FontResources::new();
-        let para = layout_paragraph(
-            &mut resources,
-            text,
-            &[StyleSpan {
-                range: 0..text.len(),
-                font_name: None,
-                font_size: 12.0,
-                bold: false,
-                weight: 400,
-                italic: false,
-                color: LayoutColor::BLACK,
-                underline: None,
-                strikethrough: None,
-                line_height: None,
-                vertical_align: None,
-                highlight_color: None,
-                letter_spacing: None,
-                font_variant: None,
-                word_spacing: None,
-                shadow: false,
-                link_url: None,
-                math: None,
-                scale: None,
-                baseline_shift: None,
-            }],
-            &ResolvedParaProps::default(),
-            400.0,
-            1.0,
-            true, // preserve_for_editing — retains the hit-test layout
-        );
-        PageParagraphData {
-            block_index,
-            layout: Arc::new(para),
-            origin,
-        }
-    }
-
-    fn two_para_continuous() -> loki_layout::ContinuousLayout {
-        let p0 = reflow_para("Hello world", 0, (0.0, 0.0));
-        let h0 = p0.layout.height;
-        let p1 = reflow_para("Second paragraph here", 1, (0.0, h0));
-        loki_layout::ContinuousLayout {
-            content_width: 400.0,
-            total_height: h0 + p1.layout.height,
-            items: vec![],
-            paragraphs: vec![p0, p1],
-        }
-    }
-
-    #[test]
-    fn reflow_tap_resolves_to_second_paragraph() {
-        let cl = two_para_continuous();
-        let h0 = cl.paragraphs[0].layout.height;
-        // A tap a couple points into the second paragraph (canvas origin (0,0),
-        // no scroll). client coords are CSS px, the band's content inset is
-        // REFLOW_PADDING_PT (removed inside the helper).
-        let client_y = pt_to_px(h0 + 2.0);
-        let client_x = pt_to_px(REFLOW_PADDING_PT + 5.0);
-        let (block, _byte) = reflow_hit_test_window(client_x, client_y, (0.0, 0.0), 0.0, &cl)
-            .expect("reflow hit lands a position");
-        assert_eq!(block, 1, "tap in the second paragraph resolves to block 1");
-    }
-
-    #[test]
-    fn reflow_tap_in_first_paragraph_resolves_to_block_0() {
-        let cl = two_para_continuous();
-        let client_y = pt_to_px(2.0); // near the top
-        let client_x = pt_to_px(REFLOW_PADDING_PT + 5.0);
-        let (block, _) =
-            reflow_hit_test_window(client_x, client_y, (0.0, 0.0), 0.0, &cl).expect("reflow hit");
-        assert_eq!(block, 0);
-    }
-
-    #[test]
-    fn reflow_tap_above_canvas_top_is_none() {
-        let cl = two_para_continuous();
-        // origin.y above the tap ⇒ canvas_y < 0 ⇒ no position.
-        assert!(reflow_hit_test_window(10.0, 10.0, (0.0, 100.0), 0.0, &cl).is_none());
-    }
-}
+#[path = "hit_test_tests.rs"]
+mod tests;
diff --git a/loki-text/src/editing/hit_test_tests.rs b/loki-text/src/editing/hit_test_tests.rs
new file mode 100644
index 00000000..949a6bc8
--- /dev/null
+++ b/loki-text/src/editing/hit_test_tests.rs
@@ -0,0 +1,369 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use std::sync::Arc;
+
+use loki_layout::{
+    FontResources, LayoutColor, LayoutInsets, LayoutPage, LayoutSize, PageEditingData,
+    PageParagraphData, PaginatedLayout, ResolvedParaProps, StyleSpan, layout_paragraph,
+};
+
+use super::*;
+
+/// Build a minimal `PaginatedLayout` with a single page containing one
+/// paragraph placed at the content-area origin.
+fn make_test_layout() -> PaginatedLayout {
+    let mut resources = FontResources::new();
+    let para = layout_paragraph(
+        &mut resources,
+        "Hello world",
+        &[StyleSpan {
+            range: 0..11,
+            font_name: None,
+            font_size: 12.0,
+            bold: false,
+            weight: 400,
+            italic: false,
+            color: LayoutColor::BLACK,
+            underline: None,
+            strikethrough: None,
+            line_height: None,
+            vertical_align: None,
+            highlight_color: None,
+            letter_spacing: None,
+            font_variant: None,
+            word_spacing: None,
+            shadow: false,
+            link_url: None,
+            math: None,
+            scale: None,
+            baseline_shift: None,
+        }],
+        &ResolvedParaProps::default(),
+        400.0,
+        1.0,
+        true, // preserve_for_editing
+    );
+    let editing_data = PageEditingData {
+        paragraphs: vec![PageParagraphData {
+            block_index: 0,
+            path: Vec::new(),
+            layout: Arc::new(para),
+            origin: (0.0, 0.0),
+        }],
+    };
+    let page_size = LayoutSize::new(595.0, 842.0);
+    let margins = LayoutInsets {
+        top: 72.0,
+        right: 72.0,
+        bottom: 72.0,
+        left: 72.0,
+    };
+    let page = LayoutPage {
+        page_number: 1,
+        page_size,
+        margins,
+        content_items: vec![],
+        header_items: vec![],
+        footer_items: vec![],
+        comment_items: vec![],
+        header_height: 0.0,
+        footer_height: 0.0,
+        editing_data: Some(editing_data),
+    };
+    PaginatedLayout {
+        page_size,
+        pages: vec![Arc::new(page)],
+    }
+}
+
+/// Convert layout points to CSS pixels (inverse of PX_TO_PT).
+fn pt_to_px(pt: f32) -> f32 {
+    pt * (96.0 / 72.0)
+}
+
+/// canvas_origin + margin offset in CSS pixels.
+fn canvas_origin_for_test() -> (f32, f32) {
+    (0.0, 0.0)
+}
+
+#[test]
+fn click_at_content_origin_returns_page0_para0_offset0() {
+    let layout = make_test_layout();
+    let page = &layout.pages[0];
+
+    // Click at the content area's (0, 0): canvas_x = margin_left, canvas_y = margin_top.
+    let page_w_px = pt_to_px(page.page_size.width);
+    let page_h_px = pt_to_px(page.page_size.height);
+    let margin_left_px = pt_to_px(page.margins.left);
+    let margin_top_px = pt_to_px(page.margins.top);
+
+    let result = hit_test_document(
+        margin_left_px, // client_x = canvas_x = margin_left in px
+        margin_top_px,  // client_y = canvas_y = margin_top in px
+        canvas_origin_for_test(),
+        0.0, // scroll_offset
+        &layout,
+        page_w_px,
+        page_h_px,
+        pt_to_px(24.0), // page_gap_px
+    );
+    let pos = result.expect("click at content origin should hit para 0");
+    assert_eq!(pos.page_index, 0);
+    assert_eq!(pos.paragraph_index, 0);
+    assert_eq!(pos.byte_offset, 0, "top-left click should land at byte 0");
+}
+
+#[test]
+fn click_below_all_content_returns_none() {
+    let layout = make_test_layout();
+    let page = &layout.pages[0];
+    let page_h_px = pt_to_px(page.page_size.height);
+    let page_w_px = pt_to_px(page.page_size.width);
+
+    // Click far below the page canvas.
+    let result = hit_test_document(
+        page_w_px / 2.0,
+        page_h_px + 100.0, // in the inter-page gap
+        canvas_origin_for_test(),
+        0.0,
+        &layout,
+        page_w_px,
+        page_h_px,
+        pt_to_px(24.0),
+    );
+    assert!(
+        result.is_none(),
+        "click below page content area must return None"
+    );
+}
+
+#[test]
+fn click_on_page2_returns_page_index_1() {
+    let layout = {
+        // Build a two-page layout by duplicating the single-page layout.
+        let single = make_test_layout();
+        let page0 = single.pages[0].clone();
+        let mut page1 = (*page0).clone();
+        page1.page_number = 2;
+        PaginatedLayout {
+            page_size: single.page_size,
+            pages: vec![page0, Arc::new(page1)],
+        }
+    };
+    let page_h_px = pt_to_px(layout.page_size.height);
+    let page_w_px = pt_to_px(layout.page_size.width);
+    let page_gap_px = pt_to_px(24.0);
+    let page = &layout.pages[1];
+    let margin_left_px = pt_to_px(page.margins.left);
+    // y at the content area of page 1 = page_height + gap + margin_top.
+    let page2_margin_top_px = pt_to_px(page.margins.top);
+    let click_y = page_h_px + page_gap_px + page2_margin_top_px;
+
+    let result = hit_test_document(
+        margin_left_px,
+        click_y,
+        canvas_origin_for_test(),
+        0.0,
+        &layout,
+        page_w_px,
+        page_h_px,
+        page_gap_px,
+    );
+    let pos = result.expect("click on page 2 should succeed");
+    assert_eq!(pos.page_index, 1, "should land on page 1 (0-based)");
+}
+
+/// Verifies that a negative canvas_y (which occurs when scroll_offset is not
+/// subtracted from page_top_y in the click handler) causes hit_test_page to
+/// return None.  This documents the root cause of the multi-page cursor bug
+/// when scroll_offset is zero but the user has scrolled.
+#[test]
+fn hit_test_page_negative_y_returns_none() {
+    let layout = make_test_layout();
+    // y < 0 means the click is above the page canvas — should return None.
+    let result = hit_test_page(0, 100.0, -10.0, &layout);
+    assert!(result.is_none(), "negative y_in_page must return None");
+}
+
+/// Verifies that passing the correct scroll_offset to hit_test_document
+/// allows a click on page 2 to be resolved when the user has scrolled.
+///
+/// This tests the mathematical contract of the coordinate transform, not
+/// Blitz scroll tracking (which is currently unimplemented — see
+/// TODO(partial-render) in editor.rs).
+#[test]
+fn scroll_offset_corrects_page2_click() {
+    let layout = {
+        let single = make_test_layout();
+        let page0 = single.pages[0].clone();
+        let mut page1 = (*page0).clone();
+        page1.page_number = 2;
+        PaginatedLayout {
+            page_size: single.page_size,
+            pages: vec![page0, Arc::new(page1)],
+        }
+    };
+    let page = &layout.pages[0];
+    let page_h_px = pt_to_px(page.page_size.height);
+    let page_w_px = pt_to_px(page.page_size.width);
+    let page_gap_px = pt_to_px(24.0);
+    let margin_left_px = pt_to_px(page.margins.left);
+    let margin_top_px = pt_to_px(page.margins.top);
+
+    // User has scrolled so that page 2 is at the top of the viewport.
+    let scroll_offset = page_h_px + page_gap_px;
+
+    // With this scroll, a click at client_y = canvas_origin.y + margin_top
+    // should resolve to the top-left content area of page 2.
+    let canvas_origin = canvas_origin_for_test();
+    let click_y = canvas_origin.1 + margin_top_px;
+
+    let result = hit_test_document(
+        margin_left_px,
+        click_y,
+        canvas_origin,
+        scroll_offset,
+        &layout,
+        page_w_px,
+        page_h_px,
+        page_gap_px,
+    );
+    let pos = result.expect("correct scroll_offset must resolve page 2 click");
+    assert_eq!(
+        pos.page_index, 1,
+        "scroll-adjusted click must land on page 1 (0-based)"
+    );
+}
+
+/// Verifies that omitting scroll_offset (passing 0) for a click that should
+/// land on page 2 returns None or lands on the wrong page — confirming that
+/// scroll_offset is required for correct multi-page hit testing.
+#[test]
+fn missing_scroll_offset_misses_page2_click() {
+    let layout = {
+        let single = make_test_layout();
+        let page0 = single.pages[0].clone();
+        let mut page1 = (*page0).clone();
+        page1.page_number = 2;
+        PaginatedLayout {
+            page_size: single.page_size,
+            pages: vec![page0, Arc::new(page1)],
+        }
+    };
+    let page = &layout.pages[0];
+    let page_h_px = pt_to_px(page.page_size.height);
+    let page_w_px = pt_to_px(page.page_size.width);
+    let page_gap_px = pt_to_px(24.0);
+    let margin_left_px = pt_to_px(page.margins.left);
+    let margin_top_px = pt_to_px(page.margins.top);
+
+    // Same scenario as above but scroll_offset is incorrectly left as 0.
+    let canvas_origin = canvas_origin_for_test();
+    let click_y = canvas_origin.1 + margin_top_px; // top of viewport when scrolled to page 2
+
+    let result = hit_test_document(
+        margin_left_px,
+        click_y,
+        canvas_origin,
+        0.0, // wrong: no scroll_offset applied
+        &layout,
+        page_w_px,
+        page_h_px,
+        page_gap_px,
+    );
+    // Without scroll_offset, click_y maps to page 0 content (near top),
+    // so result is either page 0 or None — never page 1.
+    if let Some(pos) = result {
+        assert_ne!(
+            pos.page_index, 1,
+            "without scroll_offset, click must not reach page 1"
+        );
+    }
+}
+
+// ── Reflow (continuous) hit-testing ───────────────────────────────────────
+
+/// One reflow paragraph laid out at the given canvas origin.
+fn reflow_para(text: &str, block_index: usize, origin: (f32, f32)) -> PageParagraphData {
+    let mut resources = FontResources::new();
+    let para = layout_paragraph(
+        &mut resources,
+        text,
+        &[StyleSpan {
+            range: 0..text.len(),
+            font_name: None,
+            font_size: 12.0,
+            bold: false,
+            weight: 400,
+            italic: false,
+            color: LayoutColor::BLACK,
+            underline: None,
+            strikethrough: None,
+            line_height: None,
+            vertical_align: None,
+            highlight_color: None,
+            letter_spacing: None,
+            font_variant: None,
+            word_spacing: None,
+            shadow: false,
+            link_url: None,
+            math: None,
+            scale: None,
+            baseline_shift: None,
+        }],
+        &ResolvedParaProps::default(),
+        400.0,
+        1.0,
+        true, // preserve_for_editing — retains the hit-test layout
+    );
+    PageParagraphData {
+        block_index,
+        path: Vec::new(),
+        layout: Arc::new(para),
+        origin,
+    }
+}
+
+fn two_para_continuous() -> loki_layout::ContinuousLayout {
+    let p0 = reflow_para("Hello world", 0, (0.0, 0.0));
+    let h0 = p0.layout.height;
+    let p1 = reflow_para("Second paragraph here", 1, (0.0, h0));
+    loki_layout::ContinuousLayout {
+        content_width: 400.0,
+        total_height: h0 + p1.layout.height,
+        items: vec![],
+        paragraphs: vec![p0, p1],
+    }
+}
+
+#[test]
+fn reflow_tap_resolves_to_second_paragraph() {
+    let cl = two_para_continuous();
+    let h0 = cl.paragraphs[0].layout.height;
+    // A tap a couple points into the second paragraph (canvas origin (0,0),
+    // no scroll). client coords are CSS px, the band's content inset is
+    // REFLOW_PADDING_PT (removed inside the helper).
+    let client_y = pt_to_px(h0 + 2.0);
+    let client_x = pt_to_px(REFLOW_PADDING_PT + 5.0);
+    let (block, _byte) = reflow_hit_test_window(client_x, client_y, (0.0, 0.0), 0.0, &cl)
+        .expect("reflow hit lands a position");
+    assert_eq!(block, 1, "tap in the second paragraph resolves to block 1");
+}
+
+#[test]
+fn reflow_tap_in_first_paragraph_resolves_to_block_0() {
+    let cl = two_para_continuous();
+    let client_y = pt_to_px(2.0); // near the top
+    let client_x = pt_to_px(REFLOW_PADDING_PT + 5.0);
+    let (block, _) =
+        reflow_hit_test_window(client_x, client_y, (0.0, 0.0), 0.0, &cl).expect("reflow hit");
+    assert_eq!(block, 0);
+}
+
+#[test]
+fn reflow_tap_above_canvas_top_is_none() {
+    let cl = two_para_continuous();
+    // origin.y above the tap ⇒ canvas_y < 0 ⇒ no position.
+    assert!(reflow_hit_test_window(10.0, 10.0, (0.0, 100.0), 0.0, &cl).is_none());
+}
diff --git a/loki-text/src/editing/mod.rs b/loki-text/src/editing/mod.rs
index 95f6ed5e..a7bf3f03 100644
--- a/loki-text/src/editing/mod.rs
+++ b/loki-text/src/editing/mod.rs
@@ -17,3 +17,4 @@ pub mod relayout;
 pub mod spell;
 pub mod state;
 pub mod touch;
+pub mod viewport;
diff --git a/loki-text/src/editing/navigation.rs b/loki-text/src/editing/navigation.rs
index 977bcc52..f4a46e91 100644
--- a/loki-text/src/editing/navigation.rs
+++ b/loki-text/src/editing/navigation.rs
@@ -135,11 +135,12 @@ pub fn navigate_left(
     // Verify the previous block is actually on this page before crossing.
     find_para_data(layout, focus.page_index, prev_index)?;
     let prev_text = get_text(prev_index);
-    Some(DocumentPosition {
-        page_index: focus.page_index,
-        paragraph_index: prev_index,
-        byte_offset: prev_text.len(),
-    })
+    // TODO(nested-nav): a sibling inside a cell/note body must carry its path.
+    Some(DocumentPosition::top_level(
+        focus.page_index,
+        prev_index,
+        prev_text.len(),
+    ))
 }
 
 /// Move one grapheme cluster to the right.
@@ -170,11 +171,8 @@ pub fn navigate_right(
     // Verify the next block is actually on this page.
     find_para_data(layout, focus.page_index, next_index)?;
     // TODO(3b-3): cross-page rightward navigation
-    Some(DocumentPosition {
-        page_index: focus.page_index,
-        paragraph_index: next_index,
-        byte_offset: 0,
-    })
+    // TODO(nested-nav): see navigate_left.
+    Some(DocumentPosition::top_level(focus.page_index, next_index, 0))
 }
 
 /// Move the cursor one line up, preserving the horizontal screen position.
@@ -355,6 +353,7 @@ mod tests {
         let editing_data = PageEditingData {
             paragraphs: vec![PageParagraphData {
                 block_index: 0,
+                path: Vec::new(),
                 layout: Arc::new(para),
                 origin: (0.0, 0.0),
             }],
@@ -385,11 +384,7 @@ mod tests {
     }
 
     fn focus_at(byte_offset: usize) -> DocumentPosition {
-        DocumentPosition {
-            page_index: 0,
-            paragraph_index: 0,
-            byte_offset,
-        }
+        DocumentPosition::top_level(0, 0, byte_offset)
     }
 
     #[test]
@@ -524,11 +519,13 @@ mod tests {
             paragraphs: vec![
                 PageParagraphData {
                     block_index: 0,
+                    path: Vec::new(),
                     layout: Arc::new(para0),
                     origin: (0.0, 0.0),
                 },
                 PageParagraphData {
                     block_index: 1,
+                    path: Vec::new(),
                     layout: Arc::new(para1),
                     origin: (0.0, h0),
                 },
diff --git a/loki-text/src/editing/reflow_nav.rs b/loki-text/src/editing/reflow_nav.rs
index 19f05643..c3f81e30 100644
--- a/loki-text/src/editing/reflow_nav.rs
+++ b/loki-text/src/editing/reflow_nav.rs
@@ -24,11 +24,7 @@ fn para_pos(layout: &ContinuousLayout, block_index: usize) -> Option<usize> {
 }
 
 fn pos_at(paragraph_index: usize, byte_offset: usize) -> DocumentPosition {
-    DocumentPosition {
-        page_index: 0,
-        paragraph_index,
-        byte_offset,
-    }
+    DocumentPosition::top_level(0, paragraph_index, byte_offset)
 }
 
 /// Move one grapheme left, crossing into the previous paragraph at offset 0.
@@ -193,6 +189,7 @@ mod tests {
         );
         PageParagraphData {
             block_index,
+            path: Vec::new(),
             layout: Arc::new(layout),
             origin,
         }
@@ -211,11 +208,7 @@ mod tests {
     }
 
     fn pos(p: usize, b: usize) -> DocumentPosition {
-        DocumentPosition {
-            page_index: 0,
-            paragraph_index: p,
-            byte_offset: b,
-        }
+        DocumentPosition::top_level(0, p, b)
     }
 
     #[test]
diff --git a/loki-text/src/editing/viewport.rs b/loki-text/src/editing/viewport.rs
new file mode 100644
index 00000000..33b82f88
--- /dev/null
+++ b/loki-text/src/editing/viewport.rs
@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! The measured editor viewport.
+//!
+//! **Relocated to `appthere_ui` in Spec 03 M1** so the three suite apps share
+//! one viewport + breakpoint classification (Spec 03 §5.3). This module
+//! re-exports the shared type so existing `crate::editing::viewport::Viewport`
+//! paths keep working; the type, its `centred_origin_x` centring math (Spec 01
+//! A-1/A-14), and its tests now live in `appthere_ui::responsive`.
+
+pub use appthere_ui::Viewport;
diff --git a/loki-text/src/lib.rs b/loki-text/src/lib.rs
index c4be1253..2b4a7f1c 100644
--- a/loki-text/src/lib.rs
+++ b/loki-text/src/lib.rs
@@ -1,16 +1,16 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2026 AppThere Loki contributors
 
-// SAFETY: `unsafe { loki_file_access::init_android(...) }` is required for the
-// Android NativeActivity entry point; there is no safe alternative in the
-// current android-activity / loki-file-access API.
-// TODO(safe): remove when loki-file-access exposes a safe init wrapper.
-
 //! `loki-text` library — Dioxus Native word-processor components and routing.
 //!
 //! Exposes the module tree for integration testing and potential embedding.
 //! The binary entry point lives in `main.rs` and calls [`app::App`].
 
+// The only `unsafe` in this binary is the Android FFI entry point, generated by
+// `loki_app_shell::android_main!` with its own scoped `#[allow(unsafe_code)]`
+// (Spec 01 audit A-7). Everything else is `deny`-clean.
+#![deny(unsafe_code)]
+
 pub mod app;
 pub mod components;
 pub mod editing;
@@ -22,6 +22,11 @@ pub mod sessions;
 pub mod tabs;
 pub mod utils;
 
+// Android NativeActivity entry point. Shared body lives in
+// `loki_app_shell::android_main!` so the three suite binaries don't each carry a
+// copy (Spec 01 audit A-14). `null_context`: init_android is a no-op here (the
+// JNI context comes from ndk_context) — see the macro docs.
+loki_app_shell::android_main!(tag = "LOKI", root = app::App, file_access = null_context);
 #[cfg(target_os = "android")]
 // COMPAT(android-16): On Android 16 (API 36) ANativeActivity_onCreate fires
 // twice in rapid succession, spawning two concurrent android_main threads.
diff --git a/loki-text/src/routes/editor/editor_canvas.rs b/loki-text/src/routes/editor/editor_canvas.rs
index b27dceef..bd25bdf5 100644
--- a/loki-text/src/routes/editor/editor_canvas.rs
+++ b/loki-text/src/routes/editor/editor_canvas.rs
@@ -55,6 +55,13 @@ use crate::error::LoadError;
 use loki_doc_model::loro_bridge::derive_loro_cursor;
 use loki_i18n::fl;
 
+/// Fallback viewport height (CSS px) for tile virtualization before the scroll
+/// container is first measured. A named default — not a hardcoded screen
+/// dimension assumed in a layout path (cf. the 1280px viewport bug, Spec 01
+/// audit A-1) — used only for the single frame until `get_client_rect` reports
+/// the real height.
+const DEFAULT_VIEWPORT_HEIGHT_PX: f64 = 800.0;
+
 /// Blank page placeholder shown while a document is being opened.
 ///
 /// Renders immediately when the editor tab mounts (before the async load
@@ -118,10 +125,8 @@ fn open_spell_panel_at(
             menu.anchor_x = ctx.client_x;
             menu.anchor_y = ctx.client_y;
             // Select the whole word so the user sees what the suggestions apply to.
-            let word_pos = |byte_offset| DocumentPosition {
-                page_index: pos.page_index,
-                paragraph_index: menu.paragraph_index,
-                byte_offset,
+            let word_pos = |byte_offset| {
+                DocumentPosition::top_level(pos.page_index, menu.paragraph_index, byte_offset)
             };
             cursor_state.write().anchor = Some(word_pos(menu.byte_start));
             cursor_state.write().focus = Some(word_pos(menu.byte_end));
@@ -151,7 +156,6 @@ pub(super) fn render_canvas_area(
     mut is_dragging: Signal<bool>,
     mut drag_origin: Signal<Option<(f32, f32)>>,
     touch_state: Signal<Option<TouchInteractionState>>,
-    window_width: Signal<f32>,
     mut scroll_offset: Signal<f32>,
     mut scroll_metrics: Signal<ScrollMetrics>,
     mut canvas_mounted: CanvasMounted,
@@ -281,7 +285,7 @@ pub(super) fn render_canvas_area(
                 doc_state_mousemove,
                 is_dragging,
                 drag_origin,
-                window_width,
+                scroll_metrics,
                 scroll_offset,
                 cursor_state,
                 page_gap_px,
@@ -306,7 +310,6 @@ pub(super) fn render_canvas_area(
             ontouchmove: make_touchmove_handler(
                 doc_state_touch,
                 touch_state,
-                window_width,
                 scroll_offset,
                 loro_doc,
                 cursor_state,
@@ -318,7 +321,6 @@ pub(super) fn render_canvas_area(
             ontouchend: make_touchend_handler(
                 doc_state_touchend,
                 touch_state,
-                window_width,
                 scroll_offset,
                 loro_doc,
                 cursor_state,
@@ -380,7 +382,7 @@ pub(super) fn render_canvas_area(
                             // of the viewport are GPU-rendered.
                             viewport_height_px: {
                                 let h = scroll_metrics().client_height as f64;
-                                if h > 1.0 { h } else { 800.0 }
+                                if h > 1.0 { h } else { DEFAULT_VIEWPORT_HEIGHT_PX }
                             },
                             // Real scroll offset so the renderer can virtualize
                             // tiles to the viewport (this scroll container is the
@@ -392,6 +394,10 @@ pub(super) fn render_canvas_area(
                             // Width for reflow layout; <= 0 until the canvas is
                             // measured (mount rect or first scroll event).
                             reflow_width_px: scroll_metrics().client_width as f64,
+                            // Design tokens injected so the render layer need not
+                            // depend on appthere_ui (Spec 01 audit A-8).
+                            page_gap_px: tokens::PAGE_GAP_PX as f64,
+                            content_padding_bottom_px: tokens::SPACE_6,
                             // Paginated: hit-test against the editor's paginated
                             // layout (reflow clicks are hit-tested inside
                             // DocumentView and arrive via on_reflow_click).
@@ -419,14 +425,10 @@ pub(super) fn render_canvas_area(
                                 let loro_cursor = loro_doc.read().as_ref().and_then(|ldoc| {
                                     derive_loro_cursor(ldoc, para, byte)
                                 });
-                                let pos = DocumentPosition {
-                                    // page_index is meaningless in reflow; 0 is a
-                                    // safe placeholder (the caret is painted from
-                                    // paragraph/byte, not page, in reflow mode).
-                                    page_index: 0,
-                                    paragraph_index: para,
-                                    byte_offset: byte,
-                                };
+                                // page_index is meaningless in reflow; 0 is a safe
+                                // placeholder (the caret is painted from paragraph/
+                                // byte, not page, in reflow mode).
+                                let pos = DocumentPosition::top_level(0, para, byte);
                                 let mut cs = cursor_state.write();
                                 cs.loro_cursor = loro_cursor;
                                 cs.anchor = Some(pos.clone());
@@ -440,11 +442,7 @@ pub(super) fn render_canvas_area(
                                 });
                                 let mut cs = cursor_state.write();
                                 cs.loro_cursor = loro_cursor;
-                                cs.focus = Some(DocumentPosition {
-                                    page_index: 0,
-                                    paragraph_index: para,
-                                    byte_offset: byte,
-                                });
+                                cs.focus = Some(DocumentPosition::top_level(0, para, byte));
                             },
                             // Right-click → spelling menu (paginated only). Uses
                             // accurate tile-local coordinates from the tile event.
diff --git a/loki-text/src/routes/editor/editor_docked_panels.rs b/loki-text/src/routes/editor/editor_docked_panels.rs
new file mode 100644
index 00000000..6c04ea4a
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_docked_panels.rs
@@ -0,0 +1,98 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Transient panels docked above the ribbon, triggered by toolbar actions:
+//! the spelling suggestions menu, the spelling language picker, and the Insert
+//! tab's hyperlink URL panel.
+//!
+//! Bundled into one element so `editor_inner` (an oversized file) stays lean.
+//! Each sub-panel self-gates on its own open/draft signal, so this helper can be
+//! rendered unconditionally. None of these use `position: absolute` except the
+//! spelling menu (verified to work in the current Blitz stack).
+
+use std::sync::{Arc, Mutex};
+
+use dioxus::prelude::*;
+use loki_app_shell::spell::SpellService;
+
+use super::editor_insert_panel::{InsertLinkSync, insert_link_panel};
+use super::editor_language_panel::language_panel;
+use super::editor_spell::{SpellMenu, SpellSync};
+use super::editor_spell_panel::spelling_panel;
+use crate::editing::cursor::CursorState;
+use crate::editing::state::DocumentState;
+
+/// Signals shared by the docked panels (the document handle and undo/dirty
+/// tracking). Mirrors the per-panel `*Sync` structs, built once by the caller.
+#[derive(Clone, Copy)]
+pub(super) struct DockedSync {
+    /// The document's Loro CRDT handle.
+    pub loro_doc: Signal<Option<loro::LoroDoc>>,
+    /// Cursor state (mirrors the document generation for dirty tracking).
+    pub cursor_state: Signal<CursorState>,
+    /// Undo manager, refreshed after each mutation.
+    pub undo_manager: Signal<Option<loro::UndoManager>>,
+    /// Whether undo is available.
+    pub can_undo: Signal<bool>,
+    /// Whether redo is available.
+    pub can_redo: Signal<bool>,
+}
+
+/// Renders the spelling suggestions menu, the language picker, and the Insert
+/// hyperlink panel. Each self-gates on its trigger signal.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn docked_panels(
+    doc_state: Arc<Mutex<DocumentState>>,
+    sync: DockedSync,
+    spell_service: SpellService,
+    spell_menu: Signal<Option<SpellMenu>>,
+    is_language_panel_open: Signal<bool>,
+    language_status: Signal<Option<String>>,
+    spell_hover: Signal<Option<String>>,
+    client_width: f32,
+    link_draft: Signal<Option<String>>,
+) -> Element {
+    let ds_lang = Arc::clone(&doc_state);
+    let ds_link = Arc::clone(&doc_state);
+    let spell_sync = SpellSync {
+        loro_doc: sync.loro_doc,
+        cursor_state: sync.cursor_state,
+        undo_manager: sync.undo_manager,
+        can_undo: sync.can_undo,
+        can_redo: sync.can_redo,
+    };
+    rsx! {
+        if spell_menu.read().is_some() {
+            {spelling_panel(
+                doc_state,
+                spell_sync,
+                spell_service.clone(),
+                spell_menu,
+                is_language_panel_open,
+                client_width,
+                spell_hover,
+            )}
+        }
+        if is_language_panel_open() {
+            {language_panel(
+                ds_lang,
+                sync.cursor_state,
+                spell_service,
+                is_language_panel_open,
+                language_status,
+            )}
+        }
+        if link_draft.read().is_some() {
+            {insert_link_panel(
+                ds_link,
+                link_draft,
+                InsertLinkSync {
+                    loro_doc: sync.loro_doc,
+                    cursor_state: sync.cursor_state,
+                    undo_manager: sync.undo_manager,
+                    can_undo: sync.can_undo,
+                    can_redo: sync.can_redo,
+                },
+            )}
+        }
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_font_warning.rs b/loki-text/src/routes/editor/editor_font_warning.rs
new file mode 100644
index 00000000..5c1e5968
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_font_warning.rs
@@ -0,0 +1,289 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Font-substitution warning UI (Spec 03 M3 / D3).
+//!
+//! Compact-by-default, expand-on-demand, dismissible (recovery lives in the
+//! status bar), and **breakpoint-aware**: the expanded view is a compact table
+//! on Expanded width and a vertical stack of cards on Compact — never a
+//! full-width band that wraps (the named offender). Blitz-clean: no
+//! `position: fixed`, no `box-shadow` (elevation via border/background), no CSS
+//! custom properties. All strings via `fl!()`.
+//!
+//! Owns only the warning *UI*; the substitution engine is Spec 02's.
+
+use std::collections::HashMap;
+
+use appthere_ui::tokens;
+use appthere_ui::use_breakpoint;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+/// One requested→substitute relationship, ready to render.
+struct Sub {
+    requested: String,
+    /// `Some(name)` = substituted with `name`; `None` = missing, no substitute.
+    substitute: Option<String>,
+    /// Whether the substitute is metric-compatible (low concern).
+    compatible: bool,
+    /// `(label, url)` to download the original font, where known.
+    link: Option<(&'static str, &'static str)>,
+}
+
+/// Metric-compatible substitute faces (Spec 02 §7.3). A UI-side heuristic until
+/// the substitution engine exposes severity directly; remove this list then.
+fn is_metric_compatible(substitute: &str) -> bool {
+    const COMPAT: &[&str] = &[
+        "Carlito",
+        "Caladea",
+        "Gelasio",
+        "Liberation Sans",
+        "Liberation Serif",
+        "Liberation Mono",
+    ];
+    COMPAT.iter().any(|c| c.eq_ignore_ascii_case(substitute))
+}
+
+/// Download URL for an original (requested) font, where one is known.
+fn download_link(requested: &str) -> Option<(&'static str, &'static str)> {
+    match requested.to_lowercase().as_str() {
+        "aptos" => Some((
+            "Aptos",
+            "https://www.microsoft.com/en-us/download/details.aspx?id=106037",
+        )),
+        "calibri" => Some((
+            "Calibri",
+            "https://learn.microsoft.com/en-us/typography/font-list/calibri",
+        )),
+        "cambria" => Some((
+            "Cambria",
+            "https://learn.microsoft.com/en-us/typography/font-list/cambria",
+        )),
+        "arial" => Some((
+            "Arial",
+            "https://learn.microsoft.com/en-us/typography/font-list/arial",
+        )),
+        "courier new" => Some((
+            "Courier New",
+            "https://learn.microsoft.com/en-us/typography/font-list/courier-new",
+        )),
+        "times new roman" => Some((
+            "Times New Roman",
+            "https://learn.microsoft.com/en-us/typography/font-list/times-new-roman",
+        )),
+        _ => None,
+    }
+}
+
+/// Builds the sorted, structured substitution list from the raw engine map.
+fn build_items(map: &HashMap<String, Option<String>>) -> Vec<Sub> {
+    let mut items: Vec<Sub> = map
+        .iter()
+        .map(|(requested, substitute)| Sub {
+            requested: requested.clone(),
+            substitute: substitute.clone(),
+            compatible: substitute.as_deref().is_some_and(is_metric_compatible),
+            link: download_link(requested),
+        })
+        .collect();
+    items.sort_by(|a, b| a.requested.cmp(&b.requested));
+    items
+}
+
+/// A small severity badge: calm for metric-compatible, prominent otherwise.
+fn severity_badge(compatible: bool) -> Element {
+    let (label, color) = if compatible {
+        (
+            fl!("editor-font-substitution-compatible"),
+            tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+        )
+    } else {
+        (
+            fl!("editor-font-substitution-approx"),
+            tokens::COLOR_CONTEXTUAL_TAB,
+        )
+    };
+    rsx! {
+        span {
+            style: format!(
+                "font-size: {size}px; color: {color}; border: 1px solid {color}; \
+                 border-radius: {r}px; padding: 0 {p}px; white-space: nowrap; flex-shrink: 0;",
+                size = tokens::FONT_SIZE_XS, color = color, r = tokens::RADIUS_SM, p = tokens::SPACE_1,
+            ),
+            "{label}"
+        }
+    }
+}
+
+/// The "Download original" link for a substitution, where a URL is known.
+fn download_anchor(link: Option<(&'static str, &'static str)>) -> Element {
+    let Some((_, url)) = link else {
+        return rsx! {};
+    };
+    rsx! {
+        a {
+            href: "{url}",
+            target: "_blank",
+            style: format!(
+                "color: {accent}; text-decoration: underline; font-size: {size}px; \
+                 cursor: pointer; flex-shrink: 0;",
+                accent = tokens::COLOR_TAB_ACTIVE_INDICATOR, size = tokens::FONT_SIZE_LABEL,
+            ),
+            {fl!("editor-font-download-original")}
+        }
+    }
+}
+
+/// The substitute cell text: the substitute name, or the "missing" label.
+fn substitute_text(item: &Sub) -> String {
+    item.substitute
+        .clone()
+        .unwrap_or_else(|| fl!("editor-font-substitution-missing"))
+}
+
+/// One substitution as a bordered card (Compact width — vertical stack).
+fn item_card(item: &Sub) -> Element {
+    let label_style = format!(
+        "font-size: {size}px; color: {fg};",
+        size = tokens::FONT_SIZE_XS,
+        fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+    );
+    rsx! {
+        div {
+            style: format!(
+                "display: flex; flex-direction: column; gap: {gap}px; padding: {p}px; \
+                 border: 1px solid {border}; border-radius: {r}px; background: {bg};",
+                gap = tokens::SPACE_1, p = tokens::SPACE_2, border = tokens::COLOR_BORDER_CHROME,
+                r = tokens::RADIUS_SM, bg = tokens::COLOR_SURFACE_3,
+            ),
+            div {
+                style: "display: flex; flex-direction: row; align-items: center; justify-content: space-between; gap: 8px;",
+                span {
+                    style: format!("font-size: {}px; color: {};", tokens::FONT_SIZE_BODY - 1.0, tokens::COLOR_TEXT_ON_CHROME),
+                    "{item.requested}"
+                }
+                {severity_badge(item.compatible)}
+            }
+            div {
+                style: "display: flex; flex-direction: row; align-items: center; gap: 6px;",
+                span { style: "{label_style}", {fl!("editor-font-substitution-substitute")} }
+                span {
+                    style: format!("font-size: {}px; color: {};", tokens::FONT_SIZE_LABEL, tokens::COLOR_TEXT_ON_CHROME),
+                    "{substitute_text(item)}"
+                }
+            }
+            {download_anchor(item.link)}
+        }
+    }
+}
+
+/// One substitution as a table row (Expanded width).
+fn item_row(item: &Sub) -> Element {
+    let cell = format!(
+        "flex: 1; min-width: 0; font-size: {}px; color: {};",
+        tokens::FONT_SIZE_LABEL,
+        tokens::COLOR_TEXT_ON_CHROME,
+    );
+    rsx! {
+        div {
+            style: "display: flex; flex-direction: row; align-items: center; gap: 12px;",
+            span { style: "{cell}", "{item.requested}" }
+            span { style: "{cell}", "{substitute_text(item)}" }
+            {severity_badge(item.compatible)}
+            {download_anchor(item.link)}
+        }
+    }
+}
+
+/// The font-substitution warning. Renders nothing when there are no
+/// substitutions or it has been dismissed (recovery is via the status bar).
+#[component]
+pub(super) fn FontWarning(
+    substitutions: HashMap<String, Option<String>>,
+    dismiss: Signal<bool>,
+) -> Element {
+    let mut expanded = use_signal(|| false);
+    let mut dismiss = dismiss;
+    let compact = use_breakpoint().is_compact();
+
+    if substitutions.is_empty() || dismiss() {
+        return rsx! {};
+    }
+    let items = build_items(&substitutions);
+    let count = items.len() as i64;
+
+    let container = format!(
+        "display: flex; flex-direction: column; gap: {gap}px; padding: {pv}px {ph}px; \
+         background: {bg}; border-top: 1px solid {border}; border-bottom: 1px solid {border}; \
+         font-family: {ff}; color: {fg}; flex-shrink: 0;",
+        gap = tokens::SPACE_2,
+        pv = tokens::SPACE_2,
+        ph = tokens::SPACE_4,
+        bg = tokens::COLOR_SURFACE_2,
+        border = tokens::COLOR_CONTEXTUAL_TAB,
+        ff = tokens::FONT_FAMILY_UI,
+        fg = tokens::COLOR_TEXT_ON_CHROME,
+    );
+    let btn = format!(
+        "padding: {pv}px {ph}px; background: {bg}; border: 1px solid {border}; \
+         border-radius: {r}px; color: {fg}; font-size: {size}px; cursor: pointer; flex-shrink: 0;",
+        pv = tokens::SPACE_1,
+        ph = tokens::SPACE_2,
+        bg = tokens::COLOR_SURFACE_3,
+        border = tokens::COLOR_BORDER_CHROME,
+        r = tokens::RADIUS_SM,
+        fg = tokens::COLOR_TEXT_ON_CHROME,
+        size = tokens::FONT_SIZE_LABEL,
+    );
+
+    rsx! {
+        div { style: "{container}",
+            // Header row — compact chip when collapsed, title when expanded.
+            div {
+                style: "display: flex; flex-direction: row; align-items: center; gap: 8px;",
+                span {
+                    style: format!("color: {}; font-weight: bold;", tokens::COLOR_CONTEXTUAL_TAB),
+                    if expanded() {
+                        "⚠ {fl!(\"editor-font-substitution-title\")}"
+                    } else {
+                        "⚠ {fl!(\"editor-font-substitution-chip\", count = count)}"
+                    }
+                }
+                div { style: "flex: 1;" }
+                button {
+                    style: "{btn}",
+                    onclick: move |_| { let v = expanded(); expanded.set(!v); },
+                    if expanded() {
+                        {fl!("editor-font-substitution-collapse")}
+                    } else {
+                        {fl!("editor-font-substitution-details")}
+                    }
+                }
+                button {
+                    style: "{btn}",
+                    onclick: move |_| { dismiss.set(true); },
+                    {fl!("editor-font-dismiss")}
+                }
+            }
+            // Expanded body — card stack (Compact) or table (Expanded).
+            if expanded() {
+                span {
+                    style: format!("font-size: {}px; color: {};", tokens::FONT_SIZE_LABEL, tokens::COLOR_TEXT_ON_CHROME_SECONDARY),
+                    {fl!("editor-font-substitution-message")}
+                }
+                div {
+                    style: "display: flex; flex-direction: column; gap: 6px;",
+                    for item in items.iter() {
+                        div { key: "{item.requested}",
+                            if compact { {item_card(item)} } else { {item_row(item)} }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "editor_font_warning_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/editor_font_warning_tests.rs b/loki-text/src/routes/editor/editor_font_warning_tests.rs
new file mode 100644
index 00000000..cbf75e7e
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_font_warning_tests.rs
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+use std::collections::HashMap;
+
+use super::{build_items, download_link, is_metric_compatible};
+
+#[test]
+fn metric_compatible_substitutes_are_low_concern_case_insensitively() {
+    assert!(is_metric_compatible("Carlito"));
+    assert!(is_metric_compatible("carlito"));
+    assert!(is_metric_compatible("Liberation Serif"));
+    // A genuine fallback that changes metrics is high-concern.
+    assert!(!is_metric_compatible("DejaVu Sans"));
+    assert!(!is_metric_compatible("Times New Roman"));
+}
+
+#[test]
+fn download_link_known_for_office_fonts_only() {
+    assert!(download_link("Calibri").is_some());
+    assert!(download_link("calibri").is_some()); // case-insensitive
+    assert!(download_link("Aptos").is_some());
+    assert!(download_link("Comic Sans MS").is_none());
+}
+
+#[test]
+fn build_items_sorts_and_classifies_severity_and_missing() {
+    let mut map: HashMap<String, Option<String>> = HashMap::new();
+    map.insert("Calibri".into(), Some("Carlito".into())); // metric-compatible
+    map.insert("Aptos".into(), Some("DejaVu Sans".into())); // material fallback
+    map.insert("Wingdings".into(), None); // missing, no substitute
+
+    let items = build_items(&map);
+
+    // Sorted by requested name.
+    let names: Vec<&str> = items.iter().map(|i| i.requested.as_str()).collect();
+    assert_eq!(names, vec!["Aptos", "Calibri", "Wingdings"]);
+
+    // Aptos → DejaVu Sans: a material fallback (not metric-compatible).
+    assert!(!items[0].compatible);
+    assert_eq!(items[0].substitute.as_deref(), Some("DejaVu Sans"));
+    assert!(items[0].link.is_some(), "Aptos has a download link");
+
+    // Calibri → Carlito: metric-compatible (low concern).
+    assert!(items[1].compatible);
+
+    // Wingdings: missing, no substitute, no link.
+    assert!(items[2].substitute.is_none());
+    assert!(!items[2].compatible, "missing is not 'compatible'");
+    assert!(items[2].link.is_none());
+}
diff --git a/loki-text/src/routes/editor/editor_formatting.rs b/loki-text/src/routes/editor/editor_formatting.rs
index a72347c6..7c05c51e 100644
--- a/loki-text/src/routes/editor/editor_formatting.rs
+++ b/loki-text/src/routes/editor/editor_formatting.rs
@@ -29,7 +29,7 @@
 use loki_doc_model::loro_schema::{
     MARK_BOLD, MARK_ITALIC, MARK_STRIKETHROUGH, MARK_UNDERLINE, MARK_VERTICAL_ALIGN,
 };
-use loki_doc_model::{MutationError, get_block_text, get_mark_at, mark_text};
+use loki_doc_model::{BlockPath, MutationError, get_block_text_at, get_mark_at_path, mark_text_at};
 use loro::{LoroDoc, LoroValue};
 
 use crate::editing::cursor::CursorState;
@@ -93,46 +93,48 @@ pub fn toggle_subscript(
 
 // ── Range resolution ──────────────────────────────────────────────────────────
 
-/// Resolves the format range from cursor state: `(block_index, byte_start, byte_end)`.
+/// Resolves the format range from cursor state: `(BlockPath, byte_start, byte_end)`.
 ///
-/// With a selection spanning a single block, the selection range is returned.
-/// With a point cursor (no selection), the word at the cursor is expanded.
-/// Cross-block selections are clamped to the focus block.
+/// The [`BlockPath`] addresses the focus paragraph — top-level or nested inside
+/// a table cell / note body — so formatting applies to the right container.
+/// With a selection within a single paragraph, the selection range is returned;
+/// with a point cursor, the word at the cursor is expanded; a cross-paragraph
+/// selection is clamped to the focus paragraph.
 ///
 /// Returns `None` when there is no valid cursor position.
 ///
-/// # Limitation
-///
-/// // TODO(formatting): Extend to multi-block selections by iterating blocks
-/// // between anchor and focus and applying the mark to each independently.
-pub fn resolve_format_range(loro: &LoroDoc, cursor: &CursorState) -> Option<(usize, usize, usize)> {
+/// // TODO(formatting): extend to multi-block selections.
+pub fn resolve_format_range(
+    loro: &LoroDoc,
+    cursor: &CursorState,
+) -> Option<(BlockPath, usize, usize)> {
     let focus = cursor.focus.as_ref()?;
-    let block_index = focus.paragraph_index;
+    let path = focus.block_path();
 
     if cursor.has_selection() {
         let anchor = cursor.anchor.as_ref()?;
-        if anchor.paragraph_index == focus.paragraph_index {
+        // Same paragraph requires the same index *and* the same nesting path
+        // (two cells of one table share the root index but differ by path).
+        if anchor.paragraph_index == focus.paragraph_index && anchor.path == focus.path {
             let (start, end) = if anchor.byte_offset <= focus.byte_offset {
                 (anchor.byte_offset, focus.byte_offset)
             } else {
                 (focus.byte_offset, anchor.byte_offset)
             };
             if start < end {
-                return Some((block_index, start, end));
-            }
-        } else {
-            // Cross-block: use focus block from 0 to focus offset as a best-effort.
-            if focus.byte_offset > 0 {
-                return Some((block_index, 0, focus.byte_offset));
+                return Some((path, start, end));
             }
+        } else if focus.byte_offset > 0 {
+            // Cross-paragraph: clamp to the focus paragraph as a best-effort.
+            return Some((path, 0, focus.byte_offset));
         }
     }
 
     // No selection — expand to the word at cursor.
-    let text = get_block_text(loro, block_index);
+    let text = get_block_text_at(loro, &path);
     let (word_start, word_end) = word_bounds_at(&text, focus.byte_offset);
     if word_start < word_end {
-        Some((block_index, word_start, word_end))
+        Some((path, word_start, word_end))
     } else {
         None
     }
@@ -146,12 +148,12 @@ fn toggle_string_mark(
     mark_key: &str,
     enable_value: &str,
 ) -> Result<ToggleResult, MutationError> {
-    let (block_index, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
+    let (path, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
         Some(r) => r,
         None => return Ok(false),
     };
     let active = matches!(
-        get_mark_at(loro, block_index, byte_start, mark_key)?,
+        get_mark_at_path(loro, &path, byte_start, mark_key)?,
         Some(LoroValue::String(_))
     );
     let new_value = if active {
@@ -159,7 +161,7 @@ fn toggle_string_mark(
     } else {
         LoroValue::from(enable_value.to_string())
     };
-    mark_text(loro, block_index, byte_start, byte_end, mark_key, new_value)?;
+    mark_text_at(loro, &path, byte_start, byte_end, mark_key, new_value)?;
     Ok(!active)
 }
 
@@ -168,13 +170,13 @@ fn toggle_bool_mark(
     cursor: &CursorState,
     mark_key: &str,
 ) -> Result<ToggleResult, MutationError> {
-    let (block_index, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
+    let (path, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
         Some(r) => r,
         None => return Ok(false),
     };
 
     let active = matches!(
-        get_mark_at(loro, block_index, byte_start, mark_key)?,
+        get_mark_at_path(loro, &path, byte_start, mark_key)?,
         Some(LoroValue::Bool(true))
     );
 
@@ -183,7 +185,7 @@ fn toggle_bool_mark(
     } else {
         LoroValue::Bool(true)
     };
-    mark_text(loro, block_index, byte_start, byte_end, mark_key, new_value)?;
+    mark_text_at(loro, &path, byte_start, byte_end, mark_key, new_value)?;
     Ok(!active)
 }
 
@@ -192,13 +194,13 @@ fn toggle_vertical_align(
     cursor: &CursorState,
     target_str: &str,
 ) -> Result<ToggleResult, MutationError> {
-    let (block_index, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
+    let (path, byte_start, byte_end) = match resolve_format_range(loro, cursor) {
         Some(r) => r,
         None => return Ok(false),
     };
 
     let already_active = matches!(
-        get_mark_at(loro, block_index, byte_start, MARK_VERTICAL_ALIGN)?,
+        get_mark_at_path(loro, &path, byte_start, MARK_VERTICAL_ALIGN)?,
         Some(LoroValue::String(ref s)) if s.as_str() == target_str
     );
 
@@ -209,9 +211,9 @@ fn toggle_vertical_align(
     } else {
         LoroValue::from(target_str.to_string())
     };
-    mark_text(
+    mark_text_at(
         loro,
-        block_index,
+        &path,
         byte_start,
         byte_end,
         MARK_VERTICAL_ALIGN,
diff --git a/loki-text/src/routes/editor/editor_inner.rs b/loki-text/src/routes/editor/editor_inner.rs
index 4dda794a..b3bbeda0 100644
--- a/loki-text/src/routes/editor/editor_inner.rs
+++ b/loki-text/src/routes/editor/editor_inner.rs
@@ -23,7 +23,7 @@ use std::rc::Rc;
 use std::sync::Arc;
 
 use appthere_ui::tokens;
-use appthere_ui::{AtRibbon, AtStatusBar, RibbonTabDesc};
+use appthere_ui::{AtRibbon, AtStatusBar, RibbonTabDesc, use_breakpoint};
 use dioxus::prelude::*;
 use loki_doc_model::document::Document;
 use loki_doc_model::get_mark_at;
@@ -36,20 +36,18 @@ use loki_renderer::ViewMode;
 use loro::LoroValue;
 
 use super::editor_canvas::render_canvas_area;
-use super::editor_language_panel::language_panel;
+use super::editor_docked_panels::{DockedSync, docked_panels};
 use super::editor_load::load_document;
 use super::editor_metadata_panel::metadata_panel;
 use super::editor_path_sync::{
     PathSyncSignals, restore_session, stash_outgoing, sync_path_and_reset,
 };
 use super::editor_publish::{publish_panel, publish_tab_content};
-use super::editor_ribbon::home_tab_content;
-use super::editor_save::{
-    export_document_to_token, export_template_to_token, save_document_to_path,
-};
+use super::editor_ribbon::write_tab_content;
+use super::editor_ribbon_insert::insert_tab_content;
+use super::editor_save::{export_document_to_token, save_document_to_path};
 use super::editor_save_banner::save_banner;
-use super::editor_spell::{SpellMenu, SpellSync};
-use super::editor_spell_panel::spelling_panel;
+use super::editor_spell::SpellMenu;
 use super::editor_state::{EditorState, use_editor_state};
 use super::editor_style::style_picker_panel;
 use super::editor_style_catalog::available_font_families;
@@ -67,15 +65,6 @@ use loki_file_access::{FilePicker, SaveOptions};
 /// MIME type used when saving documents (DOCX is the only writable format).
 const DOCX_MIME: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml.document";
 
-/// MIME type used by the "Save as Template" flow (Word `.dotx`).
-const DOTX_MIME: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml.template";
-
-/// Viewport width (logical px) below which the editor defaults to the
-/// reflowable view: a US-Letter page (~816px) plus margins no longer fits, so
-/// paginated view would otherwise force horizontal scrolling. The user can
-/// still toggle back to paginated.
-const REFLOW_BREAKPOINT_PX: f32 = 900.0;
-
 // EditorMode removed — the editor is always in edit mode when a document is
 // open. Distraction-free reading is handled by the View ribbon tab (future
 // pass), not by a separate mode.
@@ -105,7 +94,6 @@ pub(super) fn EditorInner(path: String) -> Element {
         is_dragging,
         drag_origin,
         touch_state,
-        window_width,
         scroll_offset,
         scroll_metrics,
         canvas_mounted,
@@ -145,6 +133,17 @@ pub(super) fn EditorInner(path: String) -> Element {
     let language_status = use_signal(|| Option::<String>::None);
     // Key of the spelling-menu row currently hovered (Blitz has no CSS :hover).
     let spell_hover = use_signal(|| Option::<String>::None);
+    // Insert-tab hyperlink panel: `Some(url)` while open (Spec 04 M4).
+    let link_draft = use_signal(|| Option::<String>::None);
+    // Character style being browsed in the style panel (Spec 05 M6 character
+    // family): `Some(id)` selects a character style for the read-only inspector.
+    let editing_char_style = use_signal(|| Option::<String>::None);
+    // List style being browsed in the style panel (Spec 05 M6 list family):
+    // `Some(id)` selects a list style for the read-only per-level inspector.
+    let editing_list_style = use_signal(|| Option::<String>::None);
+    // Compact style-panel pane (Spec 05 M7 §11): `true` = Inspect, `false` = Edit.
+    // Ignored at Expanded/Medium (both panes visible side-by-side).
+    let style_panel_inspect = use_signal(|| false);
     // Stashed sessions for inactive tabs — unsaved edits survive tab switches.
     let doc_sessions = use_context::<Signal<DocSessions>>();
     // Document generation considered "clean" (matches the on-disk file).
@@ -265,11 +264,10 @@ pub(super) fn EditorInner(path: String) -> Element {
     let doc_state_publish = Arc::clone(&doc_state);
     let doc_state_publish_panel = Arc::clone(&doc_state);
     let doc_state_meta = Arc::clone(&doc_state);
+    let doc_state_docked = Arc::clone(&doc_state);
     let doc_state_style_picker = Arc::clone(&doc_state);
     let doc_state_style_editor = Arc::clone(&doc_state);
     let doc_state_spell_ctx = Arc::clone(&doc_state);
-    let doc_state_spell_panel = Arc::clone(&doc_state);
-    let doc_state_lang_panel = Arc::clone(&doc_state);
     let doc_state_seed = Arc::clone(&doc_state);
     let doc_state_render = Arc::clone(&doc_state);
     let doc_state_scroll = Arc::clone(&doc_state);
@@ -366,11 +364,7 @@ pub(super) fn EditorInner(path: String) -> Element {
                         // the user can type immediately without clicking first.
                         if cursor_state.read().focus.is_none() {
                             use crate::editing::cursor::DocumentPosition;
-                            let start = DocumentPosition {
-                                page_index: 0,
-                                paragraph_index: 0,
-                                byte_offset: 0,
-                            };
+                            let start = DocumentPosition::top_level(0, 0, 0);
                             let mut cs = cursor_state.write();
                             cs.anchor = Some(start.clone());
                             cs.focus = Some(start);
@@ -539,36 +533,23 @@ pub(super) fn EditorInner(path: String) -> Element {
     });
 
     // ── Save as Template (.dotx) ───────────────────────────────────────────────
-    //
-    // Exports the current document as a Word template to a picked destination.
-    // Unlike Save As this does not repoint the tab — the user keeps editing their
-    // document; the template is a separate artifact.
-    let doc_state_savetmpl = Arc::clone(&doc_state);
-    let save_as_template = use_callback(move |_: ()| {
-        let doc_state = Arc::clone(&doc_state_savetmpl);
-        let mut save_message = save_message;
-        let suggested = format!("{}.dotx", display_title_from_path(&path_signal.peek()));
-        spawn(async move {
-            let picker = FilePicker::new();
-            let opts = SaveOptions {
-                mime_type: Some(DOTX_MIME.to_string()),
-                suggested_name: Some(suggested),
-            };
-            match picker.pick_file_to_save(opts).await {
-                Ok(Some(token)) => {
-                    let msg = match export_template_to_token(&token, &doc_state) {
-                        Ok(()) => fl!("editor-save-template-success"),
-                        Err(e) => fl!("editor-save-error", reason = e.to_string()),
-                    };
-                    save_message.set(Some(msg));
-                }
-                Ok(None) => { /* user cancelled — no-op */ }
-                Err(e) => {
-                    save_message.set(Some(fl!("editor-save-error", reason = e.to_string())));
-                }
-            }
-        });
-    });
+    // Self-contained save flow — extracted to keep this file under its ceiling.
+    let save_as_template = super::editor_save_callbacks::use_save_as_template_callback(
+        Arc::clone(&doc_state),
+        save_message,
+        path_signal,
+    );
+
+    // ── Insert tab handles (image insertion at the cursor) ────────────────────
+    let insert_ctx = super::editor_ribbon_insert::InsertCtx {
+        doc_state: Arc::clone(&doc_state),
+        loro_doc,
+        cursor_state,
+        undo_manager,
+        can_undo,
+        can_redo,
+        save_message,
+    };
 
     // ── Ctrl+S handler ───────────────────────────────────────────────────────
     //
@@ -595,53 +576,17 @@ pub(super) fn EditorInner(path: String) -> Element {
         save_message.set(Some(msg));
     });
 
-    // ── Measure the canvas at mount ──────────────────────────────────────────
+    // ── Viewport-driven effects (Spec 03 M1/M2) ──────────────────────────────
     //
-    // Scroll metrics are otherwise only populated by the first DOM scroll
-    // event, which would leave the view-mode default and the reflow layout
-    // width unknown until the user scrolls. Query the mounted scroll
-    // container's client rect once (backed by the dioxus-native MountedData
-    // patch) and seed the metrics.
-    use_effect(move || {
-        let Some(evt) = canvas_mounted() else { return };
-        if scroll_metrics.peek().client_width > 0.0 {
-            return;
-        }
-        let mut metrics = scroll_metrics;
-        spawn(async move {
-            if let Ok(rect) = evt.get_client_rect().await {
-                let mut m = metrics.write();
-                if m.client_width <= 0.0 {
-                    m.client_width = rect.size.width as f32;
-                    m.client_height = rect.size.height as f32;
-                }
-            }
-        });
-    });
-
-    // ── Default view mode by viewport width ──────────────────────────────────
-    //
-    // Paginated on wide viewports, reflowed on narrow ones — until the user
-    // picks a mode explicitly (which sets `view_mode_user_set` and freezes this
-    // default). The viewport width becomes known from the scroll container's
-    // `client_width`, reported on the first DOM scroll event.
-    use_effect(move || {
-        if *view_mode_user_set.read() {
-            return;
-        }
-        let width = scroll_metrics.read().client_width;
-        if width <= 0.0 {
-            return;
-        }
-        let desired = if width < REFLOW_BREAKPOINT_PX {
-            ViewMode::Reflow
-        } else {
-            ViewMode::Paginated
-        };
-        if *view_mode.peek() != desired {
-            view_mode.set(desired);
-        }
-    });
+    // Seed metrics at mount, choose the renderer by page-fit, and publish the
+    // measured width into the shared responsive context. See `editor_responsive`.
+    super::editor_responsive::use_viewport_effects(
+        canvas_mounted,
+        scroll_metrics,
+        std::sync::Arc::clone(&doc_state),
+        view_mode,
+        view_mode_user_set,
+    );
 
     let canvas_hovered = use_signal(|| false);
     let page_gap_px = tokens::PAGE_GAP_PX;
@@ -659,77 +604,20 @@ pub(super) fn EditorInner(path: String) -> Element {
         )
     };
 
-    let font_substitutions = {
-        if let Ok(state) = doc_state.lock() {
-            if let Ok(fr) = state.shared_font_resources.lock() {
-                fr.substitutions.clone()
-            } else {
-                std::collections::HashMap::new()
-            }
-        } else {
-            std::collections::HashMap::new()
-        }
-    };
-
-    let mut substituted_items = Vec::new();
-    let mut missing_items = Vec::new();
-    let mut download_links = Vec::new();
-
-    for (requested, sub) in &font_substitutions {
-        if let Some(sub_name) = sub {
-            substituted_items.push(format!("{} → {}", requested, sub_name));
-        } else {
-            missing_items.push(requested.clone());
-        }
-
-        let link = match requested.to_lowercase().as_str() {
-            "aptos" => Some((
-                "Aptos",
-                "https://www.microsoft.com/en-us/download/details.aspx?id=106037",
-            )),
-            "calibri" => Some((
-                "Calibri",
-                "https://learn.microsoft.com/en-us/typography/font-list/calibri",
-            )),
-            "cambria" => Some((
-                "Cambria",
-                "https://learn.microsoft.com/en-us/typography/font-list/cambria",
-            )),
-            "arial" => Some((
-                "Arial",
-                "https://learn.microsoft.com/en-us/typography/font-list/arial",
-            )),
-            "courier new" => Some((
-                "Courier New",
-                "https://learn.microsoft.com/en-us/typography/font-list/courier-new",
-            )),
-            "times new roman" => Some((
-                "Times New Roman",
-                "https://learn.microsoft.com/en-us/typography/font-list/times-new-roman",
-            )),
-            _ => None,
-        };
-        if let Some((label, url)) = link {
-            download_links.push((label, url));
-        }
-    }
-
-    download_links.sort_by_key(|(lbl, _)| *lbl);
-    download_links.dedup_by_key(|(lbl, _)| *lbl);
-
-    let sub_text = if !substituted_items.is_empty() {
-        format!("Substituted: {}. ", substituted_items.join(", "))
-    } else {
-        String::new()
-    };
-
-    let miss_text = if !missing_items.is_empty() {
-        format!("Missing: {}. ", missing_items.join(", "))
-    } else {
-        String::new()
-    };
-
-    let font_warning_details = format!("{}{}", sub_text, miss_text);
+    // Font substitutions reported by the layout engine (requested → substitute).
+    // The redesigned warning UI lives in `editor_font_warning`; recovery (after
+    // dismiss) is the status-bar notice chip below.
+    let font_substitutions = doc_state
+        .lock()
+        .ok()
+        .and_then(|s| {
+            s.shared_font_resources
+                .lock()
+                .ok()
+                .map(|fr| fr.substitutions.clone())
+        })
+        .unwrap_or_default();
+    let font_sub_count = font_substitutions.len() as i64;
 
     rsx! {
         div {
@@ -754,7 +642,6 @@ pub(super) fn EditorInner(path: String) -> Element {
                 is_dragging,
                 drag_origin,
                 touch_state,
-                window_width,
                 scroll_offset,
                 scroll_metrics,
                 canvas_mounted,
@@ -778,94 +665,19 @@ pub(super) fn EditorInner(path: String) -> Element {
                 doc_state_spell_ctx,
             )}
 
-            // ── Font Warning Banner ──────────────────────────────────────────
-            if !font_substitutions.is_empty() && !dismiss_font_warning() {
-                div {
-                    style: format!(
-                        "display: flex; flex-direction: row; align-items: center; justify-content: space-between; \
-                         padding: {p}px {p2}px; background: {bg}; border-top: 1px solid {border}; \
-                         border-bottom: 1px solid {border}; font-family: {ff}; font-size: {size}px; \
-                         color: {fg}; flex-shrink: 0;",
-                        p      = tokens::SPACE_2,
-                        p2     = tokens::SPACE_4,
-                        bg     = tokens::COLOR_SURFACE_2,
-                        border = tokens::COLOR_CONTEXTUAL_TAB,
-                        ff     = tokens::FONT_FAMILY_UI,
-                        size   = tokens::FONT_SIZE_BODY - 1.0,
-                        fg     = tokens::COLOR_TEXT_ON_CHROME,
-                    ),
-                    div {
-                        style: "display: flex; flex-direction: column; gap: 4px; flex: 1;",
-                        div {
-                            style: "display: flex; flex-direction: row; align-items: center; gap: 8px;",
-                            span {
-                                style: format!("color: {}; font-weight: bold;", tokens::COLOR_CONTEXTUAL_TAB),
-                                "⚠️ {fl!(\"editor-font-substitution-title\")}:"
-                            }
-                            span { {fl!("editor-font-substitution-message")} }
-                        }
-                        span {
-                            style: format!("font-size: {size}px; color: {fg_sec};",
-                                size   = tokens::FONT_SIZE_LABEL,
-                                fg_sec = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
-                            ),
-                            "{font_warning_details}"
-                        }
-                    }
-                    div {
-                        style: "display: flex; flex-direction: row; align-items: center; gap: 16px; margin-left: 16px;",
-                        if !download_links.is_empty() {
-                            div {
-                                style: "display: flex; flex-direction: row; align-items: center; gap: 8px;",
-                                span {
-                                    style: format!("font-size: {size}px; color: {fg_sec};",
-                                        size   = tokens::FONT_SIZE_LABEL,
-                                        fg_sec = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
-                                    ),
-                                    {fl!("editor-font-substitution-download")}
-                                }
-                                {
-                                    download_links.iter().map(|(label, url)| rsx! {
-                                        a {
-                                            key: "{label}",
-                                            style: format!(
-                                                "color: {accent}; text-decoration: underline; font-size: {size}px; cursor: pointer;",
-                                                accent = tokens::COLOR_TAB_ACTIVE_INDICATOR,
-                                                size   = tokens::FONT_SIZE_LABEL,
-                                            ),
-                                            href: "{url}",
-                                            target: "_blank",
-                                            "{label}"
-                                        }
-                                    })
-                                }
-                            }
-                        }
-                        button {
-                            style: format!(
-                                "padding: {p}px {p2}px; background: {bg}; border: 1px solid {border}; \
-                                 border-radius: 4px; color: {fg}; font-size: {size}px; cursor: pointer; \
-                                 margin-left: 8px;",
-                                p      = tokens::SPACE_1,
-                                p2     = tokens::SPACE_2,
-                                bg     = tokens::COLOR_SURFACE_3,
-                                border = tokens::COLOR_BORDER_CHROME,
-                                fg     = tokens::COLOR_TEXT_ON_CHROME,
-                                size   = tokens::FONT_SIZE_LABEL,
-                            ),
-                            onclick: move |_| {
-                                dismiss_font_warning.set(true);
-                            },
-                            {fl!("editor-font-dismiss")}
-                        }
-                    }
-                }
+            // ── Font-substitution warning (Spec 03 M3) ────────────────────────
+            // Compact-by-default, expand-on-demand, breakpoint-aware (table vs.
+            // card stack). Renders nothing when empty or dismissed; recovery is
+            // the status-bar notice chip below.
+            super::editor_font_warning::FontWarning {
+                substitutions: font_substitutions.clone(),
+                dismiss: dismiss_font_warning,
             }
 
             // ── Paragraph style picker panel (inline, above ribbon) ───────────
-            // Rendered between canvas and ribbon in the flex column so it
-            // works without position: absolute (unsupported in Blitz).
-            // COMPAT(dioxus-native): see editor_style.rs for layout rationale.
+            // Rendered between canvas and ribbon in the flex column — an in-flow
+            // choice (block-level position: absolute is now confirmed in Blitz;
+            // see editor_style.rs for the layout rationale).
             if *is_style_picker_open.read() {
                 {style_picker_panel(
                     doc_state_style_picker,
@@ -881,12 +693,16 @@ pub(super) fn EditorInner(path: String) -> Element {
             }
 
             // ── Style catalog editor panel (inline, above ribbon) ─────────────
-            // COMPAT(dioxus-native): position: absolute is unsupported in
-            // Blitz — rendered inline in the flex column, above the ribbon.
+            // Rendered inline in the flex column, above the ribbon (an in-flow
+            // choice; block-level position: absolute is now confirmed in Blitz).
             if editing_style_draft.read().is_some() {
                 {style_editor_panel(
                     doc_state_style_editor,
                     editing_style_draft,
+                    editing_char_style,
+                    editing_list_style,
+                    style_panel_inspect,
+                    use_breakpoint(),
                     Rc::clone(&font_families),
                     super::editor_style_editor::StyleEditorSync {
                         loro_doc,
@@ -894,40 +710,31 @@ pub(super) fn EditorInner(path: String) -> Element {
                         undo_manager,
                         can_undo,
                         can_redo,
+                        save_message,
                     },
                 )}
             }
 
-            // ── Spelling suggestions panel (right-click) ──────────────────────
-            // Docked above the ribbon (no position: absolute in Blitz).
-            if spell_menu.read().is_some() {
-                {spelling_panel(
-                    doc_state_spell_panel,
-                    SpellSync {
-                        loro_doc,
-                        cursor_state,
-                        undo_manager,
-                        can_undo,
-                        can_redo,
-                    },
-                    spell_service.clone(),
-                    spell_menu,
-                    is_language_panel_open,
-                    window_width(),
-                    spell_hover,
-                )}
-            }
-
-            // ── Spelling language picker ──────────────────────────────────────
-            if is_language_panel_open() {
-                {language_panel(
-                    doc_state_lang_panel,
+            // ── Docked panels: spelling menu, language picker, Insert link ────
+            // Each self-gates on its trigger signal. Docked above the ribbon
+            // in flow; the spelling menu uses position: absolute (confirmed).
+            {docked_panels(
+                doc_state_docked,
+                DockedSync {
+                    loro_doc,
                     cursor_state,
-                    spell_service.clone(),
-                    is_language_panel_open,
-                    language_status,
-                )}
-            }
+                    undo_manager,
+                    can_undo,
+                    can_redo,
+                },
+                spell_service.clone(),
+                spell_menu,
+                is_language_panel_open,
+                language_status,
+                spell_hover,
+                scroll_metrics().client_width,
+                link_draft,
+            )}
 
             // ── Metadata editor panel (Dublin Core) ───────────────────────────
             if editing_metadata.read().is_some() {
@@ -961,11 +768,12 @@ pub(super) fn EditorInner(path: String) -> Element {
 
             // ── Ribbon (formatting controls) ──────────────────────────────────
             AtRibbon {
-                // Only Home and Publish have controls today; the former Insert/
+                // Write, Insert, and Publish have controls today; the former
                 // Format/Review/View tabs had no content of their own (they fell
-                // through to Home's controls) and are omitted until they do.
+                // through to Write's controls) and are omitted until they do.
                 tabs: vec![
-                    RibbonTabDesc { label: fl!("ribbon-tab-home"),    is_contextual: false, aria_label: None },
+                    RibbonTabDesc { label: fl!("ribbon-tab-write"),   is_contextual: false, aria_label: None },
+                    RibbonTabDesc { label: fl!("ribbon-tab-insert"),  is_contextual: false, aria_label: None },
                     RibbonTabDesc { label: fl!("ribbon-tab-publish"), is_contextual: false, aria_label: None },
                 ],
                 active_tab: active_ribbon_tab(),
@@ -982,14 +790,15 @@ pub(super) fn EditorInner(path: String) -> Element {
                     fl!("ribbon-collapse-aria")
                 },
                 tab_content: match active_ribbon_tab() {
-                    1 => publish_tab_content(
+                    1 => insert_tab_content(link_draft, insert_ctx.clone()),
+                    2 => publish_tab_content(
                         &doc_state_publish,
                         path_signal,
                         save_message,
                         is_publish_panel_open,
                         editing_metadata,
                     ),
-                    _ => home_tab_content(
+                    _ => write_tab_content(
                     &doc_state_ribbon,
                     loro_doc,
                     cursor_state,
@@ -1040,6 +849,14 @@ pub(super) fn EditorInner(path: String) -> Element {
                     };
                     view_mode.set(next);
                 },
+                // Recover a dismissed font-substitution warning (Spec 03 M3).
+                notice_label: if dismiss_font_warning() && font_sub_count > 0 {
+                    fl!("editor-font-substitution-chip", count = font_sub_count)
+                } else {
+                    String::new()
+                },
+                notice_aria_label: fl!("editor-font-substitution-title"),
+                on_notice_click:    move |_| { dismiss_font_warning.set(false); },
             }
         }
     }
diff --git a/loki-text/src/routes/editor/editor_insert.rs b/loki-text/src/routes/editor/editor_insert.rs
new file mode 100644
index 00000000..a71601b6
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_insert.rs
@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Insert-tab create operations for the document editor.
+//!
+//! These build new document content at the cursor against the live Loro CRDT.
+//! The first operation is **hyperlink** creation — wrapping the selection (or
+//! the word at the cursor) in a [`MARK_LINK_URL`] mark, mirroring the
+//! toggle-mark pattern in [`super::editor_formatting`]. It needs no auxiliary
+//! model support and no interior editing: the linked text already exists.
+//!
+//! **Image** insertion picks a file, embeds it as a `data:` URI (the form the
+//! renderer decodes), and inserts an `Inline::Image` anchor at the cursor via
+//! the native [`insert_inline_image_at`] mapping — no interior editing required.
+//!
+//! **Table** ([`insert_table_after_cursor`]) inserts an empty grid as a new
+//! block after the cursor, and **Footnote** ([`insert_footnote_at_cursor`])
+//! anchors a note at the cursor with an empty body — both built as live CRDT
+//! containers, so their cells / body are editable via a `BlockPath`.
+
+use std::io::Cursor;
+
+use base64::Engine as _;
+use image::ImageFormat;
+use loki_doc_model::content::attr::NodeAttr;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::{Inline, LinkTarget, NoteKind};
+use loki_doc_model::content::table::core::Table;
+use loki_doc_model::loro_schema::MARK_LINK_URL;
+use loki_doc_model::{
+    MutationError, insert_block_after, insert_inline_image_at, insert_inline_note_at, mark_text_at,
+};
+use loro::{LoroDoc, LoroValue};
+
+use super::editor_formatting::resolve_format_range;
+use crate::editing::cursor::CursorState;
+
+/// EMU per CSS pixel at 96 DPI (1 inch = 914 400 EMU = 96 px). Inserted images
+/// display at their intrinsic pixel size; layout reads `cx_emu`/`cy_emu`.
+const EMU_PER_PX_96: u64 = 9525;
+
+/// Applies (or clears) a hyperlink over the selection or the word at the cursor.
+///
+/// An empty/whitespace-only `url` clears any existing link; otherwise the
+/// resolved range is marked with [`MARK_LINK_URL`]. Returns `true` when a link
+/// was applied, `false` when it was cleared or there was no resolvable range
+/// (e.g. the cursor sits on whitespace with no selection).
+pub fn set_hyperlink(
+    loro: &LoroDoc,
+    cursor: &CursorState,
+    url: &str,
+) -> Result<bool, MutationError> {
+    let Some((path, byte_start, byte_end)) = resolve_format_range(loro, cursor) else {
+        return Ok(false);
+    };
+    let trimmed = url.trim();
+    let value = if trimmed.is_empty() {
+        LoroValue::Null
+    } else {
+        LoroValue::from(trimmed.to_string())
+    };
+    mark_text_at(loro, &path, byte_start, byte_end, MARK_LINK_URL, value)?;
+    Ok(!trimmed.is_empty())
+}
+
+/// Builds an [`Inline::Image`] from raw image `bytes`, embedding them as a
+/// `data:` URI sized to the image's intrinsic pixel dimensions.
+///
+/// Returns `None` when the bytes are not a supported raster image (PNG, JPEG,
+/// GIF, WebP, BMP) — the format is detected from the bytes, not a file name, so
+/// a mislabelled extension still works (or is cleanly rejected).
+pub fn image_inline_from_bytes(bytes: &[u8]) -> Option<Inline> {
+    let reader = image::ImageReader::new(Cursor::new(bytes))
+        .with_guessed_format()
+        .ok()?;
+    let mime = match reader.format()? {
+        ImageFormat::Png => "image/png",
+        ImageFormat::Jpeg => "image/jpeg",
+        ImageFormat::Gif => "image/gif",
+        ImageFormat::WebP => "image/webp",
+        ImageFormat::Bmp => "image/bmp",
+        _ => return None,
+    };
+    let (w, h) = reader.into_dimensions().ok()?;
+    let uri = format!(
+        "data:{mime};base64,{}",
+        base64::engine::general_purpose::STANDARD.encode(bytes)
+    );
+    let mut attr = NodeAttr::default();
+    attr.kv.push((
+        "cx_emu".to_string(),
+        (u64::from(w) * EMU_PER_PX_96).to_string(),
+    ));
+    attr.kv.push((
+        "cy_emu".to_string(),
+        (u64::from(h) * EMU_PER_PX_96).to_string(),
+    ));
+    Some(Inline::Image(attr, Vec::new(), LinkTarget::new(uri)))
+}
+
+/// Inserts `image` (an [`Inline::Image`]) at the cursor's focus position.
+///
+/// Returns `true` when inserted, `false` when there is no placed cursor.
+pub fn insert_image_at_cursor(
+    loro: &LoroDoc,
+    cursor: &CursorState,
+    image: &Inline,
+) -> Result<bool, MutationError> {
+    let Some(focus) = cursor.focus.as_ref() else {
+        return Ok(false);
+    };
+    insert_inline_image_at(loro, &focus.block_path(), focus.byte_offset, image)?;
+    Ok(true)
+}
+
+/// Default dimensions for the Insert → Table control.
+const DEFAULT_TABLE_ROWS: usize = 2;
+const DEFAULT_TABLE_COLS: usize = 2;
+
+/// Inserts an empty footnote at the cursor's focus position.
+///
+/// The note anchors at the cursor and its body is a single empty paragraph the
+/// user can then edit (its body is a live container reachable via a
+/// `BlockPath`). Returns `true` when inserted, `false` when there is no cursor.
+pub fn insert_footnote_at_cursor(
+    loro: &LoroDoc,
+    cursor: &CursorState,
+) -> Result<bool, MutationError> {
+    let Some(focus) = cursor.focus.as_ref() else {
+        return Ok(false);
+    };
+    insert_inline_note_at(
+        loro,
+        &focus.block_path(),
+        focus.byte_offset,
+        &NoteKind::Footnote,
+        &[Block::Para(Vec::new())],
+    )?;
+    Ok(true)
+}
+
+/// Inserts a default empty table immediately after the cursor's (root) block.
+///
+/// Returns the new block's global index, or `None` when there is no cursor. The
+/// table's cells are empty paragraphs the user edits by clicking into them.
+pub fn insert_table_after_cursor(
+    loro: &LoroDoc,
+    cursor: &CursorState,
+) -> Result<Option<usize>, MutationError> {
+    let Some(focus) = cursor.focus.as_ref() else {
+        return Ok(None);
+    };
+    let table = Block::Table(Box::new(Table::grid(
+        DEFAULT_TABLE_ROWS,
+        DEFAULT_TABLE_COLS,
+    )));
+    let new_index = insert_block_after(loro, focus.paragraph_index, &table)?;
+    Ok(Some(new_index))
+}
+
+#[cfg(test)]
+#[path = "editor_insert_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/editor_insert_panel.rs b/loki-text/src/routes/editor/editor_insert_panel.rs
new file mode 100644
index 00000000..46d8264d
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_insert_panel.rs
@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Inline hyperlink URL panel for the Insert ribbon tab (Spec 04 M4).
+//!
+//! Rendered above the ribbon (no `position: absolute` in Blitz, mirroring the
+//! metadata and style panels). Commits the URL over the current selection / word
+//! via [`super::editor_insert::set_hyperlink`] on Apply, or clears it on Remove.
+
+use std::sync::{Arc, Mutex};
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::editor_insert::set_hyperlink;
+use super::editor_keydown_ctrl::post_mutation_sync;
+use crate::editing::cursor::CursorState;
+use crate::editing::state::{DocumentState, apply_mutation_and_relayout};
+
+/// Height of the open link panel in CSS pixels.
+pub(super) const LINK_PANEL_HEIGHT_PX: f32 = 96.0;
+
+/// Signals the link panel needs to persist the link through Loro and refresh
+/// the undo/dirty state. Grouped to keep the function signature manageable.
+#[derive(Clone, Copy)]
+pub(super) struct InsertLinkSync {
+    /// The document's Loro CRDT handle.
+    pub loro_doc: Signal<Option<loro::LoroDoc>>,
+    /// Cursor state (mirrors the document generation for dirty tracking).
+    pub cursor_state: Signal<CursorState>,
+    /// Undo manager, refreshed after the mutation.
+    pub undo_manager: Signal<Option<loro::UndoManager>>,
+    /// Whether undo is available.
+    pub can_undo: Signal<bool>,
+    /// Whether redo is available.
+    pub can_redo: Signal<bool>,
+}
+
+/// Renders the hyperlink URL panel when `link_draft` is `Some`.
+pub(super) fn insert_link_panel(
+    doc_state: Arc<Mutex<DocumentState>>,
+    mut link_draft: Signal<Option<String>>,
+    sync: InsertLinkSync,
+) -> Element {
+    let url = match link_draft.read().clone() {
+        Some(u) => u,
+        None => return rsx! {},
+    };
+    let ds_apply = Arc::clone(&doc_state);
+    let ds_remove = Arc::clone(&doc_state);
+
+    rsx! {
+        div {
+            style: format!(
+                "height: {h}px; min-height: {h}px; max-height: {h}px; \
+                 display: flex; flex-direction: column; flex-shrink: 0; \
+                 background: {bg}; border-top: 1px solid {border};",
+                h = LINK_PANEL_HEIGHT_PX,
+                bg = tokens::COLOR_SURFACE_1,
+                border = tokens::COLOR_BORDER_CHROME,
+            ),
+
+            // Header: title + close
+            div {
+                style: format!(
+                    "display: flex; flex-direction: row; align-items: center; \
+                     justify-content: space-between; padding: 0 {p}px; \
+                     flex-shrink: 0; height: 28px;",
+                    p = tokens::SPACE_4,
+                ),
+                span {
+                    style: format!(
+                        "font-family: {ff}; font-size: {fs}px; font-weight: {fw}; color: {fg};",
+                        ff = tokens::FONT_FAMILY_UI,
+                        fs = tokens::FONT_SIZE_LABEL,
+                        fw = tokens::FONT_WEIGHT_MEDIUM,
+                        fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                    ),
+                    { fl!("ribbon-insert-link-title") }
+                }
+                button {
+                    style: close_button_style(),
+                    aria_label: fl!("ribbon-insert-link-cancel"),
+                    onclick: move |_| link_draft.set(None),
+                    "\u{2715}"
+                }
+            }
+
+            // URL field
+            div {
+                style: format!(
+                    "display: flex; flex-direction: row; align-items: center; gap: {g}px; \
+                     padding: {p}px {p2}px;",
+                    g = tokens::SPACE_2,
+                    p = tokens::SPACE_2,
+                    p2 = tokens::SPACE_4,
+                ),
+                input {
+                    r#type: "text",
+                    value: "{url}",
+                    placeholder: fl!("ribbon-insert-link-placeholder"),
+                    aria_label: fl!("ribbon-insert-link-url-aria"),
+                    oninput: move |evt| link_draft.set(Some(evt.value())),
+                    style: format!(
+                        "flex: 1; height: 24px; padding: 0 {p}px; background: {bg}; \
+                         border: 1px solid {border}; border-radius: {r}px; \
+                         font-family: {ff}; font-size: {fs}px; color: {fg}; \
+                         box-sizing: border-box;",
+                        p = tokens::SPACE_2,
+                        bg = tokens::COLOR_SURFACE_2,
+                        border = tokens::COLOR_BORDER_DEFAULT,
+                        r = tokens::RADIUS_SM,
+                        ff = tokens::FONT_FAMILY_UI,
+                        fs = tokens::FONT_SIZE_BODY,
+                        fg = tokens::COLOR_TEXT_ON_CHROME,
+                    ),
+                }
+            }
+
+            // Footer: Remove + Apply
+            div {
+                style: format!(
+                    "display: flex; flex-direction: row; align-items: center; \
+                     justify-content: flex-end; gap: {g}px; padding: {p}px {p2}px; \
+                     flex-shrink: 0;",
+                    g = tokens::SPACE_2,
+                    p = tokens::SPACE_2,
+                    p2 = tokens::SPACE_4,
+                ),
+                button {
+                    style: action_button_style(false),
+                    onclick: move |_| commit_link(&ds_remove, &sync, link_draft, ""),
+                    { fl!("ribbon-insert-link-remove") }
+                }
+                button {
+                    style: action_button_style(true),
+                    onclick: move |_| {
+                        let value = link_draft.peek().clone().unwrap_or_default();
+                        commit_link(&ds_apply, &sync, link_draft, &value);
+                    },
+                    { fl!("ribbon-insert-link-apply") }
+                }
+            }
+        }
+    }
+}
+
+/// Applies `value` as a hyperlink over the current range (empty clears it),
+/// re-derives the document, refreshes undo/dirty state, and closes the panel.
+fn commit_link(
+    ds: &Arc<Mutex<DocumentState>>,
+    sync: &InsertLinkSync,
+    mut link_draft: Signal<Option<String>>,
+    value: &str,
+) {
+    let applied = {
+        let guard = sync.loro_doc.read();
+        if let Some(ldoc) = guard.as_ref() {
+            let _ = set_hyperlink(ldoc, &sync.cursor_state.read(), value);
+            apply_mutation_and_relayout(ds, ldoc);
+            true
+        } else {
+            false
+        }
+    };
+    if applied {
+        post_mutation_sync(
+            ds,
+            sync.loro_doc,
+            sync.cursor_state,
+            sync.undo_manager,
+            sync.can_undo,
+            sync.can_redo,
+        );
+    }
+    link_draft.set(None);
+}
+
+fn close_button_style() -> String {
+    format!(
+        "background: transparent; border: none; font-size: {fs}px; \
+         color: {fg}; cursor: pointer; padding: {p}px;",
+        fs = tokens::FONT_SIZE_LABEL,
+        fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+        p = tokens::SPACE_1,
+    )
+}
+
+fn action_button_style(primary: bool) -> String {
+    let (bg, fg) = if primary {
+        (tokens::COLOR_TAB_ACTIVE_BG, tokens::COLOR_TEXT_ACCENT)
+    } else {
+        (tokens::COLOR_SURFACE_3, tokens::COLOR_TEXT_ON_CHROME)
+    };
+    // Min interactive size: 44×44 logical px (WCAG 2.5.8) — Spec 03 M5 (R-15).
+    format!(
+        "min-height: {touch}px; padding: 0 {p}px; background: {bg}; border: 1px solid {border}; \
+         border-radius: {r}px; font-family: {ff}; font-size: {fs}px; color: {fg}; cursor: pointer;",
+        touch = tokens::TOUCH_MIN,
+        p = tokens::SPACE_3,
+        bg = bg,
+        border = tokens::COLOR_BORDER_CHROME,
+        r = tokens::RADIUS_SM,
+        ff = tokens::FONT_FAMILY_UI,
+        fs = tokens::FONT_SIZE_LABEL,
+        fg = fg,
+    )
+}
diff --git a/loki-text/src/routes/editor/editor_insert_tests.rs b/loki-text/src/routes/editor/editor_insert_tests.rs
new file mode 100644
index 00000000..6a6eccce
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_insert_tests.rs
@@ -0,0 +1,200 @@
+// SPDX-License-Identifier: Apache-2.0
+
+use super::*;
+use crate::editing::cursor::DocumentPosition;
+use loki_doc_model::content::block::Block;
+use loki_doc_model::content::inline::Inline;
+use loki_doc_model::document::Document;
+use loki_doc_model::{document_to_loro, get_mark_at};
+
+fn doc_with_text(text: &str) -> LoroDoc {
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Para(vec![Inline::Str(text.into())])];
+    document_to_loro(&doc).expect("document_to_loro")
+}
+
+fn pos(byte_offset: usize) -> DocumentPosition {
+    DocumentPosition::top_level(0, 0, byte_offset)
+}
+
+fn selection(start: usize, end: usize) -> CursorState {
+    CursorState {
+        loro_cursor: None,
+        anchor: Some(pos(start)),
+        focus: Some(pos(end)),
+        document_generation: 0,
+    }
+}
+
+fn link_at(loro: &LoroDoc, byte: usize) -> Option<String> {
+    match get_mark_at(loro, 0, byte, MARK_LINK_URL).expect("get_mark_at") {
+        Some(LoroValue::String(s)) => Some(s.to_string()),
+        _ => None,
+    }
+}
+
+#[test]
+fn applies_link_over_selection() {
+    let loro = doc_with_text("hello world");
+    let applied = set_hyperlink(&loro, &selection(0, 5), "https://example.com").unwrap();
+    assert!(applied);
+    assert_eq!(link_at(&loro, 0).as_deref(), Some("https://example.com"));
+    // Outside the selection there is no link.
+    assert_eq!(link_at(&loro, 7), None);
+}
+
+#[test]
+fn point_cursor_links_word_at_cursor() {
+    let loro = doc_with_text("hello world");
+    // A point cursor inside "world" links the whole word.
+    let applied = set_hyperlink(&loro, &selection(8, 8), "https://w.example").unwrap();
+    assert!(applied);
+    assert_eq!(link_at(&loro, 8).as_deref(), Some("https://w.example"));
+    assert_eq!(link_at(&loro, 0), None);
+}
+
+#[test]
+fn empty_url_clears_link_and_reports_false() {
+    let loro = doc_with_text("hello world");
+    assert!(set_hyperlink(&loro, &selection(0, 5), "https://example.com").unwrap());
+    let applied = set_hyperlink(&loro, &selection(0, 5), "   ").unwrap();
+    assert!(!applied, "blank url clears the link");
+    assert_eq!(link_at(&loro, 0), None);
+}
+
+#[test]
+fn url_is_trimmed() {
+    let loro = doc_with_text("hello world");
+    set_hyperlink(&loro, &selection(0, 5), "  https://trim.example  ").unwrap();
+    assert_eq!(link_at(&loro, 0).as_deref(), Some("https://trim.example"));
+}
+
+/// Encodes a `w`×`h` RGBA PNG into bytes for the image-insert tests.
+fn png_bytes(w: u32, h: u32) -> Vec<u8> {
+    let img = image::RgbaImage::new(w, h);
+    let mut bytes = Vec::new();
+    image::DynamicImage::ImageRgba8(img)
+        .write_to(&mut Cursor::new(&mut bytes), image::ImageFormat::Png)
+        .expect("encode png");
+    bytes
+}
+
+#[test]
+fn image_inline_carries_data_uri_and_intrinsic_size() {
+    let inline = image_inline_from_bytes(&png_bytes(2, 3)).expect("png is supported");
+    let Inline::Image(attr, _alt, target) = inline else {
+        panic!("expected an image");
+    };
+    assert!(target.url.starts_with("data:image/png;base64,"));
+    let cx = attr
+        .kv
+        .iter()
+        .find(|(k, _)| k == "cx_emu")
+        .map(|(_, v)| v.as_str());
+    let cy = attr
+        .kv
+        .iter()
+        .find(|(k, _)| k == "cy_emu")
+        .map(|(_, v)| v.as_str());
+    assert_eq!(cx, Some((2 * EMU_PER_PX_96).to_string().as_str()));
+    assert_eq!(cy, Some((3 * EMU_PER_PX_96).to_string().as_str()));
+}
+
+#[test]
+fn non_image_bytes_are_rejected() {
+    assert!(image_inline_from_bytes(b"not an image at all").is_none());
+}
+
+#[test]
+fn insert_image_at_cursor_places_a_discrete_image() {
+    let loro = doc_with_text("ab");
+    let image = image_inline_from_bytes(&png_bytes(4, 4)).unwrap();
+    let applied = insert_image_at_cursor(&loro, &selection(1, 1), &image).unwrap();
+    assert!(applied);
+    let doc = loki_doc_model::loro_to_document(&loro).unwrap();
+    let Block::Para(inlines) = &doc.sections[0].blocks[0] else {
+        panic!("para");
+    };
+    assert_eq!(inlines.len(), 3, "Str, Image, Str: {inlines:?}");
+    assert!(matches!(inlines[1], Inline::Image(..)));
+}
+
+#[test]
+fn insert_image_without_cursor_is_a_noop() {
+    let loro = doc_with_text("ab");
+    let image = image_inline_from_bytes(&png_bytes(4, 4)).unwrap();
+    let no_cursor = CursorState::new();
+    assert!(!insert_image_at_cursor(&loro, &no_cursor, &image).unwrap());
+}
+
+// ── Routing into a nested container (a table cell) ──────────────────────
+
+/// A document whose only block (index 0) is a 1×1 table; the cell holds
+/// `text`. Returns the live Loro doc.
+fn doc_with_table_cell(text: &str) -> LoroDoc {
+    use loki_doc_model::content::table::core::{
+        Table, TableBody, TableCaption, TableFoot, TableHead,
+    };
+    use loki_doc_model::content::table::row::{Cell, Row};
+    let cell = Cell::simple(vec![Block::Para(vec![Inline::Str(text.into())])]);
+    let table = Table {
+        attr: Default::default(),
+        caption: TableCaption::default(),
+        width: None,
+        col_specs: Vec::new(),
+        head: TableHead::empty(),
+        bodies: vec![TableBody::from_rows(vec![Row::new(vec![cell])])],
+        foot: TableFoot::empty(),
+    };
+    let mut doc = Document::new();
+    doc.sections[0].blocks = vec![Block::Table(Box::new(table))];
+    document_to_loro(&doc).expect("document_to_loro")
+}
+
+/// A point cursor inside cell 0 (table at block 0) at `byte_offset`.
+fn cell_cursor(byte_offset: usize) -> CursorState {
+    use loki_doc_model::PathStep;
+    let p = DocumentPosition {
+        page_index: 0,
+        paragraph_index: 0,
+        byte_offset,
+        path: vec![PathStep::Cell { cell: 0, block: 0 }],
+    };
+    CursorState {
+        loro_cursor: None,
+        anchor: Some(p.clone()),
+        focus: Some(p),
+        document_generation: 0,
+    }
+}
+
+#[test]
+fn hyperlink_routes_into_a_table_cell() {
+    let loro = doc_with_table_cell("word");
+    // Point cursor inside the cell word → links the whole word in the cell.
+    let applied = set_hyperlink(&loro, &cell_cursor(2), "https://cell.example").unwrap();
+    assert!(applied);
+    let path = loki_doc_model::BlockPath::in_cell(0, 0, 0);
+    let mark = loki_doc_model::get_mark_at_path(&loro, &path, 0, MARK_LINK_URL).unwrap();
+    assert!(
+        matches!(mark, Some(LoroValue::String(ref s)) if s.as_str() == "https://cell.example"),
+        "link must land in the cell, got {mark:?}"
+    );
+}
+
+#[test]
+fn image_routes_into_a_table_cell() {
+    let loro = doc_with_table_cell("ab");
+    let image = image_inline_from_bytes(&png_bytes(4, 4)).unwrap();
+    assert!(insert_image_at_cursor(&loro, &cell_cursor(1), &image).unwrap());
+    // Re-derive and confirm the image is a discrete inline in the cell.
+    let doc = loki_doc_model::loro_to_document(&loro).unwrap();
+    let Block::Table(t) = &doc.sections[0].blocks[0] else {
+        panic!("table");
+    };
+    let Block::Para(inlines) = &t.bodies[0].body_rows[0].cells[0].blocks[0] else {
+        panic!("cell para");
+    };
+    assert_eq!(inlines.len(), 3, "Str, Image, Str in cell: {inlines:?}");
+    assert!(matches!(inlines[1], Inline::Image(..)));
+}
diff --git a/loki-text/src/routes/editor/editor_keydown.rs b/loki-text/src/routes/editor/editor_keydown.rs
index 0780a126..105cba67 100644
--- a/loki-text/src/routes/editor/editor_keydown.rs
+++ b/loki-text/src/routes/editor/editor_keydown.rs
@@ -6,11 +6,13 @@ use std::sync::{Arc, Mutex};
 
 use dioxus::prelude::*;
 use keyboard_types::Modifiers;
-use loki_doc_model::loro_mutation::{delete_text, get_block_text, insert_text};
-use loki_doc_model::merge_block;
+use loki_doc_model::loro_mutation::{
+    delete_text_at, get_block_text, get_block_text_at, insert_text_at,
+};
+use loki_doc_model::merge_block_at;
 
 use loki_renderer::ViewMode;
-use loki_renderer::render_layout::{MIN_REFLOW_CONTENT_PT, REFLOW_PADDING_PT};
+use loki_renderer::render_layout::reflow_content_width_pt;
 
 use super::editor_keydown_ctrl::{
     handle_ctrl_keys, handle_delete_key, handle_enter_key, post_mutation_sync,
@@ -88,7 +90,7 @@ pub(super) fn make_keydown_handler(
                     let Some(ldoc) = ldoc_guard.as_ref() else {
                         return;
                     };
-                    if insert_text(ldoc, focus.paragraph_index, focus.byte_offset, &ch).is_err() {
+                    if insert_text_at(ldoc, &focus.block_path(), focus.byte_offset, &ch).is_err() {
                         return;
                     }
                 }
@@ -120,14 +122,16 @@ pub(super) fn make_keydown_handler(
             // ── Backspace ─────────────────────────────────────────────────────
             Key::Backspace => {
                 if focus.byte_offset == 0 {
-                    if focus.paragraph_index == 0 {
-                        return;
-                    }
+                    // Backspace-at-start merges this block into its previous
+                    // sibling within the same container. `merge_block_at` returns
+                    // `NoPreviousBlock` at the first block of a container (a
+                    // top-level paragraph 0 or the first block of a cell / note
+                    // body), making this a no-op there.
                     let ldoc_guard = loro_doc.read();
                     let Some(ldoc) = ldoc_guard.as_ref() else {
                         return;
                     };
-                    let Ok(merged_offset) = merge_block(ldoc, focus.paragraph_index) else {
+                    let Ok(merged_offset) = merge_block_at(ldoc, &focus.block_path()) else {
                         return;
                     };
                     apply_mutation_and_relayout(&doc_state, ldoc);
@@ -139,12 +143,9 @@ pub(super) fn make_keydown_handler(
                         can_undo,
                         can_redo,
                     );
-                    // TODO(3b-3): recompute page_index from layout after merge
-                    let new_pos = DocumentPosition {
-                        page_index: focus.page_index,
-                        paragraph_index: focus.paragraph_index - 1,
-                        byte_offset: merged_offset,
-                    };
+                    // TODO(3b-3): recompute page_index from layout after merge.
+                    // Caret lands at the join point in the previous sibling block.
+                    let new_pos = focus.sibling_block(-1, merged_offset);
                     let mut cs = cursor_state.write();
                     cs.focus = Some(new_pos.clone());
                     cs.anchor = Some(new_pos);
@@ -154,7 +155,7 @@ pub(super) fn make_keydown_handler(
                     let ldoc_guard = loro_doc.read();
                     ldoc_guard
                         .as_ref()
-                        .map(|l| get_block_text(l, focus.paragraph_index))
+                        .map(|l| get_block_text_at(l, &focus.block_path()))
                         .unwrap_or_default()
                 };
                 let prev = prev_grapheme_boundary(&text, focus.byte_offset);
@@ -164,7 +165,7 @@ pub(super) fn make_keydown_handler(
                     let Some(ldoc) = ldoc_guard.as_ref() else {
                         return;
                     };
-                    if delete_text(ldoc, focus.paragraph_index, prev, len).is_err() {
+                    if delete_text_at(ldoc, &focus.block_path(), prev, len).is_err() {
                         return;
                     }
                 }
@@ -229,8 +230,7 @@ pub(super) fn make_keydown_handler(
                     if width_px <= 1.0 {
                         return;
                     }
-                    let content_w = (width_px * (72.0 / 96.0) - 2.0 * REFLOW_PADDING_PT)
-                        .max(MIN_REFLOW_CONTENT_PT);
+                    let content_w = reflow_content_width_pt(width_px);
                     let Some(layout) = ensure_reflow_layout(&doc_state, content_w) else {
                         return;
                     };
diff --git a/loki-text/src/routes/editor/editor_keydown_ctrl.rs b/loki-text/src/routes/editor/editor_keydown_ctrl.rs
index 1bc36384..e0e786bc 100644
--- a/loki-text/src/routes/editor/editor_keydown_ctrl.rs
+++ b/loki-text/src/routes/editor/editor_keydown_ctrl.rs
@@ -9,8 +9,8 @@ use std::sync::{Arc, Mutex};
 
 use dioxus::prelude::*;
 use keyboard_types::{Key, Modifiers};
-use loki_doc_model::loro_mutation::{delete_text, get_block_text};
-use loki_doc_model::{StyleId, get_block_style_name, set_block_style, split_block};
+use loki_doc_model::loro_mutation::{delete_text_at, get_block_text, get_block_text_at};
+use loki_doc_model::{StyleId, get_block_style_name, set_block_style, split_block_at};
 
 use super::editor_formatting;
 use crate::editing::cursor::{CursorState, DocumentPosition, next_grapheme_boundary};
@@ -43,11 +43,7 @@ pub(super) fn handle_ctrl_keys(
                 state.paginated_layout.clone()
             };
             if let Some(layout) = layout_opt {
-                let first = DocumentPosition {
-                    page_index: 0,
-                    paragraph_index: 0,
-                    byte_offset: 0,
-                };
+                let first = DocumentPosition::top_level(0, 0, 0);
                 let last_opt = layout
                     .pages
                     .iter()
@@ -67,11 +63,7 @@ pub(super) fn handle_ctrl_keys(
                         .as_ref()
                         .map(|l| get_block_text(l, last_block).len())
                         .unwrap_or(0);
-                    let last = DocumentPosition {
-                        page_index: last_page,
-                        paragraph_index: last_block,
-                        byte_offset: end_offset,
-                    };
+                    let last = DocumentPosition::top_level(last_page, last_block, end_offset);
                     let mut cs = cursor_state.write();
                     cs.anchor = Some(first);
                     cs.focus = Some(last);
@@ -153,7 +145,7 @@ pub(super) fn handle_delete_key(
         let ldoc_guard = loro_doc.read();
         ldoc_guard
             .as_ref()
-            .map(|l| get_block_text(l, focus.paragraph_index))
+            .map(|l| get_block_text_at(l, &focus.block_path()))
             .unwrap_or_default()
     };
     if focus.byte_offset >= text.len() {
@@ -166,7 +158,7 @@ pub(super) fn handle_delete_key(
         let Some(ldoc) = ldoc_guard.as_ref() else {
             return;
         };
-        if delete_text(ldoc, focus.paragraph_index, focus.byte_offset, len).is_err() {
+        if delete_text_at(ldoc, &focus.block_path(), focus.byte_offset, len).is_err() {
             return;
         }
     }
@@ -203,8 +195,14 @@ pub(super) fn handle_enter_key(
         return;
     };
 
+    let nested = !focus.path.is_empty();
+
     // Resolve next_style_id for the current block's style before splitting.
-    let next_style: Option<String> = {
+    // Style inheritance via next_style_id is a top-level concern (named styles
+    // address top-level paragraphs); nested splits keep the source block's type.
+    let next_style: Option<String> = if nested {
+        None
+    } else {
         let style_name = get_block_style_name(ldoc, focus.paragraph_index);
         doc_state.lock().ok().and_then(|state| {
             state
@@ -217,7 +215,7 @@ pub(super) fn handle_enter_key(
         })
     };
 
-    if split_block(ldoc, focus.paragraph_index, focus.byte_offset).is_err() {
+    if split_block_at(ldoc, &focus.block_path(), focus.byte_offset).is_err() {
         return;
     }
 
@@ -235,12 +233,10 @@ pub(super) fn handle_enter_key(
         can_undo,
         can_redo,
     );
-    // TODO(3b-3): recompute page_index from layout after split
-    let new_pos = DocumentPosition {
-        page_index: focus.page_index,
-        paragraph_index: focus.paragraph_index + 1,
-        byte_offset: 0,
-    };
+    // TODO(3b-3): recompute page_index from layout after split.
+    // The split inserts the new block right after the source within the same
+    // container, so the caret moves to the next sibling block at offset 0.
+    let new_pos = focus.sibling_block(1, 0);
     let mut cs = cursor_state.write();
     cs.focus = Some(new_pos.clone());
     cs.anchor = Some(new_pos);
diff --git a/loki-text/src/routes/editor/editor_language_panel.rs b/loki-text/src/routes/editor/editor_language_panel.rs
index 4c294914..51d7b94f 100644
--- a/loki-text/src/routes/editor/editor_language_panel.rs
+++ b/loki-text/src/routes/editor/editor_language_panel.rs
@@ -186,10 +186,13 @@ fn muted_style() -> String {
 }
 
 fn action_style() -> String {
+    // Min interactive size: 44×44 logical px (WCAG 2.5.8) — Spec 03 M5 (R-15).
     format!(
-        "padding: {p}px {p2}px; background: {bg}; border: 1px solid {border}; \
+        "min-height: {touch}px; display: inline-flex; align-items: center; \
+         padding: {p}px {p2}px; background: {bg}; border: 1px solid {border}; \
          border-radius: 4px; color: {fg}; font-size: {size}px; cursor: pointer; \
          flex-shrink: 0;",
+        touch = tokens::TOUCH_MIN,
         p = tokens::SPACE_1,
         p2 = tokens::SPACE_3,
         bg = tokens::COLOR_SURFACE_3,
diff --git a/loki-text/src/routes/editor/editor_metadata_panel.rs b/loki-text/src/routes/editor/editor_metadata_panel.rs
index e0c73e78..41919f1d 100644
--- a/loki-text/src/routes/editor/editor_metadata_panel.rs
+++ b/loki-text/src/routes/editor/editor_metadata_panel.rs
@@ -220,9 +220,11 @@ fn action_button_style(primary: bool) -> String {
     } else {
         (tokens::COLOR_SURFACE_3, tokens::COLOR_TEXT_ON_CHROME)
     };
+    // Min interactive size: 44×44 logical px (WCAG 2.5.8) — Spec 03 M5 (R-15).
     format!(
-        "min-height: 28px; padding: 0 {p}px; background: {bg}; border: 1px solid {border}; \
+        "min-height: {touch}px; padding: 0 {p}px; background: {bg}; border: 1px solid {border}; \
          border-radius: {r}px; font-family: {ff}; font-size: {fs}px; color: {fg}; cursor: pointer;",
+        touch = tokens::TOUCH_MIN,
         p = tokens::SPACE_3,
         bg = bg,
         border = tokens::COLOR_BORDER_CHROME,
diff --git a/loki-text/src/routes/editor/editor_pointer.rs b/loki-text/src/routes/editor/editor_pointer.rs
index c09fae75..2f849cac 100644
--- a/loki-text/src/routes/editor/editor_pointer.rs
+++ b/loki-text/src/routes/editor/editor_pointer.rs
@@ -10,35 +10,34 @@ use loki_doc_model::loro_bridge::derive_loro_cursor;
 use loki_doc_model::loro_mutation::get_block_text;
 
 use loki_renderer::ViewMode;
-use loki_renderer::render_layout::{MIN_REFLOW_CONTENT_PT, REFLOW_PADDING_PT};
+use loki_renderer::render_layout::{reflow_content_width_pt, reflow_tile_width_px};
 
 use crate::editing::cursor::{CursorState, DocumentPosition};
 use crate::editing::hit_test::{hit_test_document, reflow_hit_test_window};
 use crate::editing::state::{DocumentState, ensure_reflow_layout};
 use crate::editing::touch::{TouchInteractionState, TouchPhase, word_boundaries_at};
+use crate::editing::viewport::Viewport;
 use crate::routes::editor::editor_scrollbar::ScrollMetrics;
 
-/// CSS pixels → layout points (72 dpi / 96 dpi).
-const PX_TO_PT: f32 = 72.0 / 96.0;
-
 /// Resolves a window-relative tap to a reflow document position, using the same
 /// continuous layout width as the painted view. Returns `None` outside reflow
 /// mode or when the canvas has not been measured yet.
 fn reflow_tap_position(
     doc_state: &Arc<Mutex<DocumentState>>,
     client_pos: (f32, f32),
-    window_width: f32,
-    client_width_px: f32,
+    viewport: Viewport,
     scroll_offset: f32,
 ) -> Option<(usize, usize)> {
+    let client_width_px = viewport.inner_width_px;
     if client_width_px <= 1.0 {
         return None;
     }
-    let content_w =
-        (client_width_px * PX_TO_PT - 2.0 * REFLOW_PADDING_PT).max(MIN_REFLOW_CONTENT_PT);
+    let content_w = reflow_content_width_pt(client_width_px);
     let layout = ensure_reflow_layout(doc_state, content_w)?;
-    // Reflow tiles span the canvas client width, centred in the window.
-    let x_off = ((window_width - client_width_px) / 2.0).max(0.0);
+    // Reflow tiles are capped to a reading measure and centred in the viewport
+    // (`margin: auto` on paint); the hit-test origin uses the same tile width so
+    // clicks land on the painted glyphs (Spec 03 M4).
+    let x_off = viewport.centred_origin_x(reflow_tile_width_px(client_width_px));
     let origin = (x_off, tokens::TOOLBAR_HEIGHT_TOP + tokens::SPACE_6);
     reflow_hit_test_window(client_pos.0, client_pos.1, origin, scroll_offset, &layout)
 }
@@ -57,7 +56,7 @@ pub(super) fn make_mousemove_handler(
     doc_state: Arc<Mutex<DocumentState>>,
     mut is_dragging: Signal<bool>,
     drag_origin: Signal<Option<(f32, f32)>>,
-    window_width: Signal<f32>,
+    scroll_metrics: Signal<ScrollMetrics>,
     scroll_offset: Signal<f32>,
     mut cursor_state: Signal<CursorState>,
     page_gap_px: f32,
@@ -95,7 +94,8 @@ pub(super) fn make_mousemove_handler(
             )
         };
         let Some(layout) = layout_opt else { return };
-        let x_off = (window_width() - page_width_px).max(0.0) / 2.0;
+        let viewport = Viewport::new(scroll_metrics.peek().client_width);
+        let x_off = viewport.centred_origin_x(page_width_px);
         let origin = (x_off, tokens::TOOLBAR_HEIGHT_TOP + tokens::SPACE_6);
         if let Some(p) = hit_test_document(
             cx,
@@ -117,7 +117,6 @@ pub(super) fn make_mousemove_handler(
 pub(super) fn make_touchmove_handler(
     doc_state: Arc<Mutex<DocumentState>>,
     mut touch_state: Signal<Option<TouchInteractionState>>,
-    window_width: Signal<f32>,
     scroll_offset: Signal<f32>,
     loro_doc: Signal<Option<loro::LoroDoc>>,
     mut cursor_state: Signal<CursorState>,
@@ -149,8 +148,7 @@ pub(super) fn make_touchmove_handler(
                 reflow_tap_position(
                     &doc_state,
                     start,
-                    window_width(),
-                    scroll_metrics.peek().client_width,
+                    Viewport::new(scroll_metrics.peek().client_width),
                     scroll_offset(),
                 )
                 .map(|(para, byte)| (0, para, byte))
@@ -164,7 +162,8 @@ pub(super) fn make_touchmove_handler(
                     )
                 };
                 layout_opt.and_then(|layout| {
-                    let x_off = (window_width() - page_width_px).max(0.0) / 2.0;
+                    let viewport = Viewport::new(scroll_metrics.peek().client_width);
+                    let x_off = viewport.centred_origin_x(page_width_px);
                     let origin = (x_off, tokens::TOOLBAR_HEIGHT_TOP + tokens::SPACE_6);
                     hit_test_document(
                         start.0,
@@ -185,16 +184,8 @@ pub(super) fn make_touchmove_handler(
                     let text = get_block_text(ldoc, para);
                     if let Some((ws, we)) = word_boundaries_at(&text, byte) {
                         let mut cs = cursor_state.write();
-                        cs.anchor = Some(DocumentPosition {
-                            page_index: page,
-                            paragraph_index: para,
-                            byte_offset: ws,
-                        });
-                        cs.focus = Some(DocumentPosition {
-                            page_index: page,
-                            paragraph_index: para,
-                            byte_offset: we,
-                        });
+                        cs.anchor = Some(DocumentPosition::top_level(page, para, ws));
+                        cs.focus = Some(DocumentPosition::top_level(page, para, we));
                     }
                 }
             }
@@ -208,7 +199,6 @@ pub(super) fn make_touchmove_handler(
 pub(super) fn make_touchend_handler(
     doc_state: Arc<Mutex<DocumentState>>,
     mut touch_state: Signal<Option<TouchInteractionState>>,
-    window_width: Signal<f32>,
     scroll_offset: Signal<f32>,
     loro_doc: Signal<Option<loro::LoroDoc>>,
     mut cursor_state: Signal<CursorState>,
@@ -224,19 +214,14 @@ pub(super) fn make_touchend_handler(
                 if let Some((para, byte)) = reflow_tap_position(
                     &doc_state,
                     ts.start_pos,
-                    window_width(),
-                    scroll_metrics.peek().client_width,
+                    Viewport::new(scroll_metrics.peek().client_width),
                     scroll_offset(),
                 ) {
                     let loro_cursor = loro_doc
                         .read()
                         .as_ref()
                         .and_then(|ldoc| derive_loro_cursor(ldoc, para, byte));
-                    let pos = DocumentPosition {
-                        page_index: 0,
-                        paragraph_index: para,
-                        byte_offset: byte,
-                    };
+                    let pos = DocumentPosition::top_level(0, para, byte);
                     let mut cs = cursor_state.write();
                     cs.loro_cursor = loro_cursor;
                     cs.anchor = Some(pos.clone());
@@ -257,7 +242,8 @@ pub(super) fn make_touchend_handler(
                     )
                 };
                 if let Some(layout) = layout_opt {
-                    let x_off = (window_width() - page_width_px).max(0.0) / 2.0;
+                    let viewport = Viewport::new(scroll_metrics.peek().client_width);
+                    let x_off = viewport.centred_origin_x(page_width_px);
                     let origin = (x_off, tokens::TOOLBAR_HEIGHT_TOP + tokens::SPACE_6);
                     if let Some(pos) = hit_test_document(
                         ts.start_pos.0,
diff --git a/loki-text/src/routes/editor/editor_responsive.rs b/loki-text/src/routes/editor/editor_responsive.rs
new file mode 100644
index 00000000..dbd5cce1
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_responsive.rs
@@ -0,0 +1,106 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 AppThere Loki contributors
+
+//! Viewport-driven editor effects (Spec 03 M1).
+//!
+//! Extracted from `editor_inner` so the responsive wiring lives in one place and
+//! the over-ceiling `editor_inner` shrinks rather than grows. All three effects
+//! derive from the **one** measured scroll-container width — there is no second
+//! width source (Spec 01 A-1 / Spec 03 §2):
+//!
+//! 1. seed `scroll_metrics` from `get_client_rect` at mount (so the width is
+//!    known before the first scroll),
+//! 2. choose the renderer by **page-fit** (Spec 03 M2) — paginated when a page
+//!    column fits, reflowed otherwise, hysteretic to avoid thrash — until the
+//!    user freezes the mode,
+//! 3. publish the measured width into the shared `appthere_ui` responsive
+//!    context so any component can read the derived [`Breakpoint`].
+//!
+//! [`Breakpoint`]: appthere_ui::Breakpoint
+
+use std::sync::{Arc, Mutex};
+
+use appthere_ui::{AtResponsiveContext, PageFit, Viewport, resolve_page_fit};
+use dioxus::prelude::*;
+use loki_renderer::ViewMode;
+
+use super::editor_scrollbar::{CanvasMounted, ScrollMetrics};
+use crate::editing::state::DocumentState;
+
+/// Wires the three viewport-driven effects (see the module docs).
+pub(super) fn use_viewport_effects(
+    canvas_mounted: CanvasMounted,
+    scroll_metrics: Signal<ScrollMetrics>,
+    doc_state: Arc<Mutex<DocumentState>>,
+    mut view_mode: Signal<ViewMode>,
+    view_mode_user_set: Signal<bool>,
+) {
+    // 1. Seed the metrics at mount. Otherwise `client_width` stays 0 until the
+    //    first DOM scroll, leaving the view-mode default and reflow width unknown.
+    use_effect(move || {
+        let Some(evt) = canvas_mounted() else { return };
+        if scroll_metrics.peek().client_width > 0.0 {
+            return;
+        }
+        let mut metrics = scroll_metrics;
+        spawn(async move {
+            if let Ok(rect) = evt.get_client_rect().await {
+                let mut m = metrics.write();
+                if m.client_width <= 0.0 {
+                    m.client_width = rect.size.width as f32;
+                    m.client_height = rect.size.height as f32;
+                }
+            }
+        });
+    });
+
+    // 2. Default the view mode by **page fit** (Spec 03 M2 / D2) — paginated when
+    //    a full page column fits the measured viewport at the current zoom,
+    //    reflowed when it would force horizontal scrolling — until the user picks
+    //    a mode (which freezes this default). The decision is hysteretic on the
+    //    *current* mode, so dragging across the boundary doesn't thrash.
+    {
+        let doc_state = Arc::clone(&doc_state);
+        use_effect(move || {
+            if *view_mode_user_set.read() {
+                return;
+            }
+            let width = scroll_metrics.read().client_width;
+            if width <= 0.0 {
+                return;
+            }
+            // Page geometry is per-document (CSS px); falls back to the A4 token
+            // default if the state lock is unavailable. Zoom is fixed at 100%
+            // until zoom is implemented — `resolve_page_fit` already scales by
+            // `Viewport::zoom`, so this becomes live for free when it lands.
+            let page_width_px = doc_state
+                .lock()
+                .map_or(appthere_ui::tokens::PAGE_WIDTH_PX, |s| s.page_width_px);
+            let currently_paginated = *view_mode.peek() == ViewMode::Paginated;
+            let desired =
+                match resolve_page_fit(Viewport::new(width), page_width_px, currently_paginated) {
+                    PageFit::Paginated => ViewMode::Paginated,
+                    PageFit::Reflow => ViewMode::Reflow,
+                };
+            if *view_mode.peek() != desired {
+                view_mode.set(desired);
+            }
+        });
+    }
+
+    // 3. Publish the measured width into the shared responsive context so the
+    //    breakpoint derives from the same value the renderer/hit-test use. Zoom
+    //    and DPI are preserved for the Spec 03 M2 page-fit switch to populate.
+    let responsive = use_context::<AtResponsiveContext>();
+    use_effect(move || {
+        let width = scroll_metrics.read().client_width;
+        let mut viewport = responsive.viewport;
+        let prev = *viewport.peek();
+        if (prev.inner_width_px - width).abs() > f32::EPSILON {
+            viewport.set(Viewport {
+                inner_width_px: width,
+                ..prev
+            });
+        }
+    });
+}
diff --git a/loki-text/src/routes/editor/editor_ribbon.rs b/loki-text/src/routes/editor/editor_ribbon.rs
index c24bc858..352b03ab 100644
--- a/loki-text/src/routes/editor/editor_ribbon.rs
+++ b/loki-text/src/routes/editor/editor_ribbon.rs
@@ -1,8 +1,8 @@
 // SPDX-License-Identifier: Apache-2.0
 
-//! Home tab ribbon content for the document editor.
+//! Write tab ribbon content for the document editor (was "Home", Spec 04 D1).
 //!
-//! [`home_tab_content`] returns the `Element` passed to [`AtRibbon::tab_content`].
+//! [`write_tab_content`] returns the `Element` passed to [`AtRibbon::tab_content`].
 //! Separating it here keeps `editor_inner.rs` under the 300-line ceiling and
 //! makes ribbon content easy to extend independently.
 
@@ -28,7 +28,7 @@ use super::editor_state::StyleDraft;
 use super::editor_style_catalog::get_catalog_style;
 use super::editor_style_editor::style_to_draft;
 
-/// Builds the Home tab ribbon content element.
+/// Builds the Write tab ribbon content element.
 ///
 /// Called once per render cycle from `EditorInner`.  The six formatting
 /// signals drive the `is_active` state of each button.  Each button's
@@ -38,7 +38,7 @@ use super::editor_style_editor::style_to_draft;
 /// Because [`Signal<T>`] is `Copy`, all signal parameters are copied freely
 /// into closures.  One `Arc::clone` is made per button for `doc_state`.
 #[allow(clippy::too_many_arguments)]
-pub(super) fn home_tab_content(
+pub(super) fn write_tab_content(
     doc_state: &Arc<Mutex<DocumentState>>,
     loro_doc: Signal<Option<LoroDoc>>,
     cursor_state: Signal<CursorState>,
@@ -76,7 +76,7 @@ pub(super) fn home_tab_content(
     rsx! {
         // ── Document group ────────────────────────────────────────────────────
         AtRibbonGroup {
-            label:      None,
+            label:      Some(fl!("ribbon-group-document")),
             aria_label: fl!("ribbon-group-document"),
 
             AtRibbonIconButton {
@@ -127,7 +127,7 @@ pub(super) fn home_tab_content(
 
         // ── History group ─────────────────────────────────────────────────────
         AtRibbonGroup {
-            label:      None,
+            label:      Some(fl!("ribbon-group-history")),
             aria_label: fl!("ribbon-group-history"),
 
             AtRibbonIconButton {
@@ -173,7 +173,7 @@ pub(super) fn home_tab_content(
 
         // ── Styles group ──────────────────────────────────────────────────────
         AtRibbonGroup {
-            label:      None,
+            label:      Some(fl!("ribbon-group-styles")),
             aria_label: fl!("ribbon-group-styles"),
 
             AtRibbonSelect {
@@ -189,7 +189,7 @@ pub(super) fn home_tab_content(
 
         // ── Paragraph group ───────────────────────────────────────────────────
         AtRibbonGroup {
-            label:      None,
+            label:      Some(fl!("ribbon-group-paragraph")),
             aria_label: fl!("ribbon-group-paragraph"),
 
             AtRibbonIconButton {
@@ -217,7 +217,7 @@ pub(super) fn home_tab_content(
 
         // ── Inline formatting group ───────────────────────────────────────────
         AtRibbonGroup {
-            label:      None,
+            label:      Some(fl!("ribbon-group-inline")),
             aria_label: fl!("ribbon-group-inline"),
 
             AtRibbonIconButton {
diff --git a/loki-text/src/routes/editor/editor_ribbon_insert.rs b/loki-text/src/routes/editor/editor_ribbon_insert.rs
new file mode 100644
index 00000000..54b5a9f0
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_ribbon_insert.rs
@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Insert tab ribbon content for the document editor (Spec 04 M4).
+//!
+//! [`insert_tab_content`] returns the `Element` passed to
+//! [`AtRibbon::tab_content`] when the Insert tab is active. It hosts the create
+//! controls for objects with a native Loro mapping:
+//!
+//! - **Image** — picks a file, embeds it as a `data:` URI, and inserts an
+//!   `Inline::Image` at the cursor (see [`super::editor_insert`]).
+//! - **Table** — inserts an empty 2×2 table after the cursor's block; its cells
+//!   are live editable containers (click in to edit).
+//! - **Footnote** — inserts a footnote at the cursor with an empty, editable
+//!   body.
+//! - **Link** — opens the URL panel ([`super::editor_insert_panel`]).
+
+use std::io::Read;
+use std::sync::{Arc, Mutex};
+
+use appthere_ui::{
+    AtIcon, AtRibbonGroup, AtRibbonIconButton, LUCIDE_FOOTNOTE, LUCIDE_IMAGE, LUCIDE_LINK,
+    LUCIDE_TABLE,
+};
+use dioxus::prelude::*;
+use loki_doc_model::MutationError;
+use loki_file_access::{FileAccessToken, FilePicker, PickOptions};
+use loki_i18n::fl;
+use loro::LoroDoc;
+
+use super::editor_insert::{
+    image_inline_from_bytes, insert_footnote_at_cursor, insert_image_at_cursor,
+    insert_table_after_cursor,
+};
+use super::editor_keydown_ctrl::post_mutation_sync;
+use crate::editing::cursor::CursorState;
+use crate::editing::state::{DocumentState, apply_mutation_and_relayout};
+
+/// Raster image MIME types offered in the Insert → Image picker.
+const IMAGE_MIME_TYPES: &[&str] = &[
+    "image/png",
+    "image/jpeg",
+    "image/gif",
+    "image/webp",
+    "image/bmp",
+];
+
+/// Live-document handles the Insert tab needs to create objects at the cursor.
+#[derive(Clone)]
+pub(super) struct InsertCtx {
+    /// Document state for relayout after a mutation.
+    pub doc_state: Arc<Mutex<DocumentState>>,
+    /// The document's Loro CRDT handle.
+    pub loro_doc: Signal<Option<loro::LoroDoc>>,
+    /// Cursor state — the insertion point and dirty-tracking generation.
+    pub cursor_state: Signal<CursorState>,
+    /// Undo manager, refreshed after the mutation.
+    pub undo_manager: Signal<Option<loro::UndoManager>>,
+    /// Whether undo is available.
+    pub can_undo: Signal<bool>,
+    /// Whether redo is available.
+    pub can_redo: Signal<bool>,
+    /// Status-banner sink for success / error feedback.
+    pub save_message: Signal<Option<String>>,
+}
+
+/// Builds the Insert tab ribbon content element.
+///
+/// `link_draft` is the shared hyperlink-panel signal (setting it to `Some("")`
+/// opens the URL panel); `ctx` carries the handles the Image button needs to
+/// pick a file and insert it at the cursor.
+pub(super) fn insert_tab_content(
+    mut link_draft: Signal<Option<String>>,
+    ctx: InsertCtx,
+) -> Element {
+    rsx! {
+        // ── Media group ───────────────────────────────────────────────────────
+        AtRibbonGroup {
+            label:      Some(fl!("ribbon-group-media")),
+            aria_label: fl!("ribbon-group-media"),
+
+            AtRibbonIconButton {
+                aria_label:  fl!("ribbon-insert-image-aria"),
+                is_active:   false,
+                is_disabled: false,
+                on_click: {
+                    let ctx = ctx.clone();
+                    move |_| spawn_pick_and_insert_image(ctx.clone())
+                },
+                AtIcon { path_d: LUCIDE_IMAGE.to_string() }
+            }
+        }
+
+        // ── Tables group ──────────────────────────────────────────────────────
+        AtRibbonGroup {
+            label:      Some(fl!("ribbon-group-tables")),
+            aria_label: fl!("ribbon-group-tables"),
+
+            AtRibbonIconButton {
+                aria_label:  fl!("ribbon-insert-table-aria"),
+                is_active:   false,
+                is_disabled: false,
+                on_click: {
+                    let ctx = ctx.clone();
+                    move |_| run_insert(
+                        &ctx,
+                        |ldoc, cur| insert_table_after_cursor(ldoc, cur).map(|o| o.is_some()),
+                        fl!("editor-insert-table-success"),
+                    )
+                },
+                AtIcon { path_d: LUCIDE_TABLE.to_string() }
+            }
+        }
+
+        // ── References group ──────────────────────────────────────────────────
+        AtRibbonGroup {
+            label:      Some(fl!("ribbon-group-references")),
+            aria_label: fl!("ribbon-group-references"),
+
+            AtRibbonIconButton {
+                aria_label:  fl!("ribbon-insert-footnote-aria"),
+                is_active:   false,
+                is_disabled: false,
+                on_click: {
+                    let ctx = ctx.clone();
+                    move |_| run_insert(&ctx, insert_footnote_at_cursor, fl!("editor-insert-footnote-success"))
+                },
+                AtIcon { path_d: LUCIDE_FOOTNOTE.to_string() }
+            }
+        }
+
+        // ── Links group ───────────────────────────────────────────────────────
+        AtRibbonGroup {
+            label:      Some(fl!("ribbon-group-links")),
+            aria_label: fl!("ribbon-group-links"),
+
+            AtRibbonIconButton {
+                aria_label:  fl!("ribbon-insert-link-aria"),
+                is_active:   link_draft.read().is_some(),
+                is_disabled: false,
+                on_click: move |_| {
+                    if link_draft.read().is_some() {
+                        link_draft.set(None);
+                    } else {
+                        link_draft.set(Some(String::new()));
+                    }
+                },
+                AtIcon { path_d: LUCIDE_LINK.to_string() }
+            }
+        }
+    }
+}
+
+/// Runs a synchronous Insert-tab `op` against the live document, relays out,
+/// syncs undo/redo, and reports the outcome through the status banner.
+///
+/// `op` returns `Ok(true)` when it mutated, `Ok(false)` when there was no
+/// cursor, or `Err` on failure — surfaced as the no-cursor / failure messages.
+fn run_insert(
+    ctx: &InsertCtx,
+    op: impl FnOnce(&LoroDoc, &CursorState) -> Result<bool, MutationError>,
+    success: String,
+) {
+    let mut save_message = ctx.save_message;
+    let outcome = {
+        let guard = ctx.loro_doc.read();
+        let Some(ldoc) = guard.as_ref() else {
+            return;
+        };
+        match op(ldoc, &ctx.cursor_state.read()) {
+            Ok(true) => {
+                apply_mutation_and_relayout(&ctx.doc_state, ldoc);
+                Some(true)
+            }
+            Ok(false) => Some(false),
+            Err(_) => None,
+        }
+    };
+    match outcome {
+        Some(true) => {
+            post_mutation_sync(
+                &ctx.doc_state,
+                ctx.loro_doc,
+                ctx.cursor_state,
+                ctx.undo_manager,
+                ctx.can_undo,
+                ctx.can_redo,
+            );
+            save_message.set(Some(success));
+        }
+        Some(false) => save_message.set(Some(fl!("editor-insert-no-cursor"))),
+        None => save_message.set(Some(fl!("editor-insert-failed"))),
+    }
+}
+
+/// Reads all bytes from a picked file token.
+fn read_token_bytes(token: &FileAccessToken) -> std::io::Result<Vec<u8>> {
+    let mut reader = token
+        .open_read()
+        .map_err(|e| std::io::Error::other(e.to_string()))?;
+    let mut buf = Vec::new();
+    reader.read_to_end(&mut buf)?;
+    Ok(buf)
+}
+
+/// Spawns the async pick → embed → insert flow for an image at the cursor.
+///
+/// Opens the platform file picker, reads the chosen file, builds a data-URI
+/// `Inline::Image`, inserts it at the cursor, and reports the outcome through
+/// the status banner. A cancelled picker is a silent no-op.
+fn spawn_pick_and_insert_image(ctx: InsertCtx) {
+    let mut save_message = ctx.save_message;
+    spawn(async move {
+        let picker = FilePicker::new();
+        let opts = PickOptions {
+            mime_types: IMAGE_MIME_TYPES.iter().map(|s| (*s).to_string()).collect(),
+            filter_label: Some(fl!("ribbon-insert-image-filter")),
+            multi: false,
+        };
+        match picker.pick_file_to_open(opts).await {
+            Ok(Some(token)) => {
+                let bytes = match read_token_bytes(&token) {
+                    Ok(b) => b,
+                    Err(e) => {
+                        save_message.set(Some(fl!(
+                            "editor-insert-image-error",
+                            reason = e.to_string()
+                        )));
+                        return;
+                    }
+                };
+                let Some(image) = image_inline_from_bytes(&bytes) else {
+                    save_message.set(Some(fl!("editor-insert-image-unsupported")));
+                    return;
+                };
+                let outcome = {
+                    let guard = ctx.loro_doc.read();
+                    match guard.as_ref() {
+                        Some(ldoc) => {
+                            match insert_image_at_cursor(ldoc, &ctx.cursor_state.read(), &image) {
+                                Ok(true) => {
+                                    apply_mutation_and_relayout(&ctx.doc_state, ldoc);
+                                    Some(true)
+                                }
+                                Ok(false) => Some(false),
+                                Err(_) => None,
+                            }
+                        }
+                        None => None,
+                    }
+                };
+                match outcome {
+                    Some(true) => {
+                        post_mutation_sync(
+                            &ctx.doc_state,
+                            ctx.loro_doc,
+                            ctx.cursor_state,
+                            ctx.undo_manager,
+                            ctx.can_undo,
+                            ctx.can_redo,
+                        );
+                        save_message.set(Some(fl!("editor-insert-image-success")));
+                    }
+                    Some(false) => save_message.set(Some(fl!("editor-insert-image-no-cursor"))),
+                    None => save_message.set(Some(fl!("editor-insert-image-error", reason = "—"))),
+                }
+            }
+            Ok(None) => { /* user cancelled — no-op */ }
+            Err(e) => save_message.set(Some(fl!(
+                "editor-insert-image-error",
+                reason = e.to_string()
+            ))),
+        }
+    });
+}
diff --git a/loki-text/src/routes/editor/editor_save_callbacks.rs b/loki-text/src/routes/editor/editor_save_callbacks.rs
new file mode 100644
index 00000000..22ce1011
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_save_callbacks.rs
@@ -0,0 +1,55 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Save-dialog callbacks extracted from `editor_inner` (an oversized file).
+//!
+//! Currently hosts the **Save as Template** flow, which is self-contained (it
+//! does not repoint the tab or navigate). Save As stays in `editor_inner`
+//! because it also touches tab/recents/navigation state.
+
+use std::sync::{Arc, Mutex};
+
+use dioxus::prelude::*;
+use loki_file_access::{FilePicker, SaveOptions};
+use loki_i18n::fl;
+
+use super::editor_save::export_template_to_token;
+use crate::editing::state::DocumentState;
+use crate::utils::display_title_from_path;
+
+/// MIME type used by the "Save as Template" flow (Word `.dotx`).
+const DOTX_MIME: &str = "application/vnd.openxmlformats-officedocument.wordprocessingml.template";
+
+/// Builds the "Save as Template" callback: exports the current document as a
+/// Word template (`.dotx`) to a picked destination. Unlike Save As it does not
+/// repoint the tab — the template is a separate artifact.
+pub(super) fn use_save_as_template_callback(
+    doc_state: Arc<Mutex<DocumentState>>,
+    save_message: Signal<Option<String>>,
+    path_signal: Signal<String>,
+) -> Callback<()> {
+    use_callback(move |_: ()| {
+        let doc_state = Arc::clone(&doc_state);
+        let mut save_message = save_message;
+        let suggested = format!("{}.dotx", display_title_from_path(&path_signal.peek()));
+        spawn(async move {
+            let picker = FilePicker::new();
+            let opts = SaveOptions {
+                mime_type: Some(DOTX_MIME.to_string()),
+                suggested_name: Some(suggested),
+            };
+            match picker.pick_file_to_save(opts).await {
+                Ok(Some(token)) => {
+                    let msg = match export_template_to_token(&token, &doc_state) {
+                        Ok(()) => fl!("editor-save-template-success"),
+                        Err(e) => fl!("editor-save-error", reason = e.to_string()),
+                    };
+                    save_message.set(Some(msg));
+                }
+                Ok(None) => { /* user cancelled — no-op */ }
+                Err(e) => {
+                    save_message.set(Some(fl!("editor-save-error", reason = e.to_string())));
+                }
+            }
+        });
+    })
+}
diff --git a/loki-text/src/routes/editor/editor_spell_panel.rs b/loki-text/src/routes/editor/editor_spell_panel.rs
index 3122c556..8f204d2c 100644
--- a/loki-text/src/routes/editor/editor_spell_panel.rs
+++ b/loki-text/src/routes/editor/editor_spell_panel.rs
@@ -40,15 +40,16 @@ pub(super) fn spelling_panel(
     service: SpellService,
     mut spell_menu: Signal<Option<SpellMenu>>,
     mut is_language_panel_open: Signal<bool>,
-    window_width: f32,
+    viewport_width: f32,
     spell_hover: Signal<Option<String>>,
 ) -> Element {
     let Some(menu) = spell_menu.read().clone() else {
         return rsx! {};
     };
 
-    // Clamp horizontally so the menu never spills off the right edge.
-    let max_left = (window_width - MENU_WIDTH_PX - EDGE_MARGIN_PX).max(0.0);
+    // Clamp horizontally so the menu never spills off the measured viewport's
+    // right edge.
+    let max_left = (viewport_width - MENU_WIDTH_PX - EDGE_MARGIN_PX).max(0.0);
     let left = menu.anchor_x.clamp(0.0, max_left);
     let top = menu.anchor_y.max(0.0);
 
diff --git a/loki-text/src/routes/editor/editor_state.rs b/loki-text/src/routes/editor/editor_state.rs
index c0cbe000..0fb100d0 100644
--- a/loki-text/src/routes/editor/editor_state.rs
+++ b/loki-text/src/routes/editor/editor_state.rs
@@ -87,7 +87,6 @@ pub(super) struct EditorState {
     pub is_dragging: Signal<bool>,
     pub drag_origin: Signal<Option<(f32, f32)>>,
     pub touch_state: Signal<Option<TouchInteractionState>>,
-    pub window_width: Signal<f32>,
     pub scroll_offset: Signal<f32>,
     /// Live scroll geometry of the canvas container, mirrored from the most
     /// recent DOM `scroll` event and consumed by the custom scrollbars.
@@ -174,7 +173,6 @@ pub(super) fn use_editor_state() -> EditorState {
         is_dragging: use_signal(|| false),
         drag_origin: use_signal(|| None),
         touch_state: use_signal(|| None),
-        window_width: use_signal(|| 1280.0_f32),
         scroll_offset: use_signal(|| 0.0_f32),
         scroll_metrics: use_signal(ScrollMetrics::default),
         canvas_mounted: use_signal(|| None),
diff --git a/loki-text/src/routes/editor/editor_style_catalog.rs b/loki-text/src/routes/editor/editor_style_catalog.rs
index adfb696e..969e3fdb 100644
--- a/loki-text/src/routes/editor/editor_style_catalog.rs
+++ b/loki-text/src/routes/editor/editor_style_catalog.rs
@@ -5,9 +5,53 @@
 use std::sync::{Arc, Mutex};
 
 use loki_doc_model::style::ParagraphStyle;
-use loki_doc_model::style::catalog::StyleId;
+use loki_doc_model::style::catalog::{StyleCatalog, StyleId};
 
-use crate::editing::state::DocumentState;
+use crate::editing::state::{DocumentState, apply_mutation_and_relayout};
+
+/// Why a style delete was refused.
+pub(super) enum DeleteError {
+    /// Built-in / default styles are protected from deletion (Spec 05 §8).
+    Builtin,
+    /// The style id is not in the catalog (or no document is loaded).
+    NotFound,
+}
+
+/// Deletes the paragraph style `id` (re-parenting its children to the
+/// grandparent), persists the catalog, and relays out. Built-in styles are
+/// refused. On success returns the number of re-parented child styles for the
+/// caller's confirmation message. The caller refreshes undo bookkeeping.
+pub(super) fn perform_style_delete(
+    loro: &loro::LoroDoc,
+    doc_state: &Arc<Mutex<DocumentState>>,
+    id: &str,
+) -> Result<usize, DeleteError> {
+    let mut catalog = catalog_snapshot(doc_state).ok_or(DeleteError::NotFound)?;
+    let sid = StyleId::new(id);
+    let style = catalog
+        .paragraph_styles
+        .get(&sid)
+        .ok_or(DeleteError::NotFound)?;
+    if style.is_builtin() {
+        return Err(DeleteError::Builtin);
+    }
+    let reparented = catalog.delete_paragraph_style(&sid).len();
+    if let Err(e) = loki_doc_model::loro_bridge::write_document_styles(loro, &catalog) {
+        tracing::warn!("failed to persist style catalog to Loro: {e}");
+    }
+    loro.commit();
+    apply_mutation_and_relayout(doc_state, loro);
+    Ok(reparented)
+}
+
+/// Clones the document's current [`StyleCatalog`] for read-only inspection
+/// (e.g. the provenance inspector). Returns `None` when no document is loaded.
+pub(super) fn catalog_snapshot(doc_state: &Arc<Mutex<DocumentState>>) -> Option<StyleCatalog> {
+    doc_state
+        .lock()
+        .ok()
+        .and_then(|s| s.document.as_ref().map(|d| d.styles.clone()))
+}
 
 /// Inserts or replaces a paragraph style in the catalog and persists the result
 /// through the Loro CRDT, committing it as a discrete, undoable transaction.
@@ -34,6 +78,24 @@ pub(super) fn commit_style_to_loro(
     loro.commit();
 }
 
+/// Clears the local override of `property` on the paragraph style `id` and
+/// persists the result through Loro (a discrete, undoable transaction) — the
+/// "reset to inherited" action (Spec 05 §6). A no-op when the style is absent.
+///
+/// The caller relays out and refreshes undo bookkeeping (as for
+/// [`commit_style_to_loro`]).
+pub(super) fn reset_style_property(
+    loro: &loro::LoroDoc,
+    doc_state: &Arc<Mutex<DocumentState>>,
+    id: &str,
+    property: super::style_inspector::StyleProperty,
+) {
+    if let Some(mut style) = get_catalog_style(doc_state, id) {
+        super::style_inspector::clear_local_property(&mut style, property);
+        commit_style_to_loro(loro, doc_state, style);
+    }
+}
+
 /// Generates a unique id string for a new custom style.
 pub(super) fn new_custom_style_id(doc_state: &Arc<Mutex<DocumentState>>) -> String {
     let Ok(state) = doc_state.lock() else {
@@ -83,26 +145,25 @@ pub(super) fn available_font_families(doc_state: &Arc<Mutex<DocumentState>>) ->
     fr.available_font_families()
 }
 
-/// Returns `(style_id, display_name)` pairs for all catalog styles, sorted by display name.
-pub(super) fn catalog_style_list(doc_state: &Arc<Mutex<DocumentState>>) -> Vec<(String, String)> {
-    let Ok(state) = doc_state.lock() else {
-        return vec![];
-    };
-    let Some(doc) = &state.document else {
+/// Returns `(style_id, display_name, depth)` for all catalog paragraph styles in
+/// inheritance-tree pre-order (parents before their subtrees), for the tree-view
+/// picker (Spec 05 §7). `depth` is the indentation level.
+pub(super) fn catalog_style_tree(
+    doc_state: &Arc<Mutex<DocumentState>>,
+) -> Vec<(String, String, usize)> {
+    let Some(catalog) = catalog_snapshot(doc_state) else {
         return vec![];
     };
-    let mut entries: Vec<(String, String)> = doc
-        .styles
-        .paragraph_styles
-        .iter()
-        .map(|(id, style)| {
-            let display = style
-                .display_name
-                .clone()
+    catalog
+        .para_forest_preorder()
+        .into_iter()
+        .map(|(id, depth)| {
+            let display = catalog
+                .paragraph_styles
+                .get(&id)
+                .and_then(|s| s.display_name.clone())
                 .unwrap_or_else(|| id.as_str().to_string());
-            (id.as_str().to_string(), display)
+            (id.as_str().to_string(), display, depth)
         })
-        .collect();
-    entries.sort_by(|(_, a), (_, b)| a.cmp(b));
-    entries
+        .collect()
 }
diff --git a/loki-text/src/routes/editor/editor_style_editor/actions.rs b/loki-text/src/routes/editor/editor_style_editor/actions.rs
new file mode 100644
index 00000000..7aabedd6
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/actions.rs
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Style management actions for the editor panel (Spec 05 M5).
+//!
+//! [`delete_button`] renders the Delete control for the currently-edited style.
+//! It is shown only for user styles (`can_delete`); built-in/default styles are
+//! protected (§8). Deleting re-parents the style's children to the grandparent
+//! (handled in the model), reports how many were re-parented, and closes the
+//! panel. Extracted from `form.rs` to keep that file under the 300-line ceiling.
+
+use std::sync::{Arc, Mutex};
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::super::editor_keydown_ctrl::post_mutation_sync;
+use super::super::editor_state::StyleDraft;
+use super::super::editor_style_catalog::{DeleteError, perform_style_delete};
+use super::StyleEditorSync;
+use crate::editing::state::DocumentState;
+
+/// The Delete control. Returns an empty element when `can_delete` is false, so
+/// built-in styles show no affordance.
+pub(super) fn delete_button(
+    can_delete: bool,
+    doc_state: Arc<Mutex<DocumentState>>,
+    style_id: String,
+    mut editing_style_draft: Signal<Option<StyleDraft>>,
+    sync: StyleEditorSync,
+) -> Element {
+    if !can_delete {
+        return rsx! {};
+    }
+    rsx! {
+        button {
+            style: format!(
+                "padding: {p}px {p2}px; border-radius: {r}px; \
+                 border: 1px solid {border}; cursor: pointer; \
+                 font-family: {ff}; font-size: {fs}px; \
+                 background: transparent; color: {fg};",
+                p = tokens::SPACE_1,
+                p2 = tokens::SPACE_3,
+                r = tokens::RADIUS_SM,
+                border = tokens::COLOR_BORDER_CHROME,
+                ff = tokens::FONT_FAMILY_UI,
+                fs = tokens::FONT_SIZE_BODY,
+                fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+            ),
+            aria_label: fl!("style-delete-aria"),
+            onclick: move |_| {
+                let result = {
+                    let guard = sync.loro_doc.read();
+                    guard.as_ref().map(|ldoc| perform_style_delete(ldoc, &doc_state, &style_id))
+                };
+                let mut save_message = sync.save_message;
+                match result {
+                    Some(Ok(n)) => {
+                        post_mutation_sync(
+                            &doc_state,
+                            sync.loro_doc,
+                            sync.cursor_state,
+                            sync.undo_manager,
+                            sync.can_undo,
+                            sync.can_redo,
+                        );
+                        save_message.set(Some(fl!("style-delete-success", count = n as i64)));
+                        editing_style_draft.set(None); // close the panel; the style is gone
+                    }
+                    Some(Err(DeleteError::Builtin)) => {
+                        save_message.set(Some(fl!("style-delete-builtin")));
+                    }
+                    _ => {}
+                }
+            },
+            { fl!("style-delete-label") }
+        }
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/body.rs b/loki-text/src/routes/editor/editor_style_editor/body.rs
new file mode 100644
index 00000000..38357ae8
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/body.rs
@@ -0,0 +1,172 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The style panel's left navigation column and the Compact section switcher
+//! (Spec 05 M7). Extracted from `mod.rs` so the panel shell stays under the
+//! 300-line ceiling and the posture-dependent layout lives in one place.
+//!
+//! `left_column` renders the inheritance-tree picker, the "+ New" button, and the
+//! character/list family lists; every control honours [`StylePanelPosture`]'s
+//! touch minimum. `section_switcher` is the Compact-only Edit/Inspect segmented
+//! control that chooses which stacked group is visible (§11).
+
+use std::sync::{Arc, Mutex};
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::super::editor_state::StyleDraft;
+use super::super::editor_style_catalog::{get_catalog_style, new_custom_style_id};
+use super::posture::StylePanelPosture;
+use super::style_to_draft;
+use super::{char_browser, list_browser};
+use crate::editing::state::DocumentState;
+
+/// The panel's left navigation column: inheritance tree + "+ New" + family lists.
+#[allow(clippy::too_many_arguments)]
+pub(super) fn left_column(
+    doc_state: Arc<Mutex<DocumentState>>,
+    styles: Vec<(String, String, usize)>,
+    active_id: String,
+    mut editing_style_draft: Signal<Option<StyleDraft>>,
+    new_style_parent: String,
+    char_list: Vec<(String, String)>,
+    char_selected: Option<String>,
+    editing_char_style: Signal<Option<String>>,
+    list_list: Vec<(String, String)>,
+    list_selected: Option<String>,
+    editing_list_style: Signal<Option<String>>,
+    posture: StylePanelPosture,
+) -> Element {
+    let ds_new = Arc::clone(&doc_state);
+    rsx! {
+        div {
+            style: format!(
+                "width: {w}; min-width: {w}; overflow-y: auto; \
+                 border-right: 1px solid {border}; display: flex; \
+                 flex-direction: column; gap: 2px; padding: {p}px;",
+                w = posture.section_width(160.0),
+                border = tokens::COLOR_BORDER_CHROME,
+                p = tokens::SPACE_2,
+            ),
+
+            // Inheritance-tree picker: styles indented by depth so the
+            // parent → child hierarchy is visible (Spec 05 §7).
+            {styles.into_iter().map(|(id, display, depth)| {
+                let is_active = id == active_id;
+                let ds_c = Arc::clone(&doc_state);
+                let id_cap = id.clone();
+                rsx! {
+                    button {
+                        key: "{id}",
+                        style: format!(
+                            "text-align: left; padding: {p}px {p2}px; \
+                             padding-left: {indent}px; {touch} \
+                             border-radius: 3px; border: 1px solid {border}; \
+                             cursor: pointer; font-family: {ff}; \
+                             font-size: {fs}px; background: {bg}; color: {fg};",
+                            p = tokens::SPACE_1, p2 = tokens::SPACE_2,
+                            touch = posture.touch_min_css(),
+                            indent = tokens::SPACE_2 + depth as f32 * tokens::SPACE_3,
+                            border = if is_active { tokens::COLOR_TAB_ACTIVE_INDICATOR } else { tokens::COLOR_BORDER_CHROME },
+                            ff = tokens::FONT_FAMILY_UI,
+                            fs = tokens::FONT_SIZE_LABEL,
+                            bg = if is_active { tokens::COLOR_SURFACE_3 } else { tokens::COLOR_SURFACE_2 },
+                            fg = tokens::COLOR_TEXT_ON_CHROME,
+                        ),
+                        onclick: move |_| {
+                            if let Some(s) = get_catalog_style(&ds_c, &id_cap) {
+                                editing_style_draft.set(Some(style_to_draft(&s)));
+                            }
+                        },
+                        "{display}"
+                    }
+                }
+            })}
+
+            button {
+                style: format!(
+                    "padding: {p}px {p2}px; border-radius: 3px; margin-top: {mt}px; {touch} \
+                     border: 1px solid {border}; cursor: pointer; \
+                     font-family: {ff}; font-size: {fs}px; \
+                     background: {bg}; color: {fg};",
+                    p = tokens::SPACE_1, p2 = tokens::SPACE_2,
+                    mt = tokens::SPACE_2,
+                    touch = posture.touch_min_css(),
+                    border = tokens::COLOR_BORDER_DEFAULT,
+                    ff = tokens::FONT_FAMILY_UI,
+                    fs = tokens::FONT_SIZE_LABEL,
+                    bg = tokens::COLOR_SURFACE_2,
+                    fg = tokens::COLOR_TEXT_ON_CHROME,
+                ),
+                aria_label: fl!("ribbon-style-new-aria"),
+                onclick: move |_| {
+                    let new_id = new_custom_style_id(&ds_new);
+                    editing_style_draft.set(Some(StyleDraft {
+                        id: new_id.clone(),
+                        name: new_id,
+                        is_custom: true,
+                        // Inherit from the current style; leave props empty so
+                        // every value shows as inherited.
+                        parent: new_style_parent.clone(),
+                        ..StyleDraft::default()
+                    }));
+                },
+                { fl!("editor-style-new") }
+            }
+
+            // ── Character styles (§9 character family) ─────────────────────────
+            { char_browser::char_list_section(char_list, char_selected, editing_char_style, posture) }
+
+            // ── List styles (§9 list family, non-inheriting) ───────────────────
+            { list_browser::list_list_section(list_list, list_selected, editing_list_style, posture) }
+        }
+    }
+}
+
+/// The Compact-only Edit/Inspect segmented control (§11). At Compact the body
+/// stacks, so only one group is shown at a time; this toggles between them.
+pub(super) fn section_switcher(mut inspect: Signal<bool>) -> Element {
+    let seg = |active: bool| {
+        format!(
+            "flex: 1; min-height: {touch}px; border: 1px solid {border}; \
+             cursor: pointer; font-family: {ff}; font-size: {fs}px; \
+             background: {bg}; color: {fg};",
+            touch = tokens::TOUCH_MIN,
+            border = if active {
+                tokens::COLOR_TAB_ACTIVE_INDICATOR
+            } else {
+                tokens::COLOR_BORDER_CHROME
+            },
+            ff = tokens::FONT_FAMILY_UI,
+            fs = tokens::FONT_SIZE_LABEL,
+            bg = if active {
+                tokens::COLOR_SURFACE_3
+            } else {
+                tokens::COLOR_SURFACE_2
+            },
+            fg = tokens::COLOR_TEXT_ON_CHROME,
+        )
+    };
+    let showing_inspect = *inspect.read();
+    rsx! {
+        div {
+            style: format!(
+                "display: flex; flex-direction: row; gap: {gap}px; \
+                 flex-shrink: 0; padding: {p}px;",
+                gap = tokens::SPACE_1,
+                p = tokens::SPACE_2,
+            ),
+            button {
+                style: seg(!showing_inspect),
+                onclick: move |_| inspect.set(false),
+                { fl!("style-section-edit") }
+            }
+            button {
+                style: seg(showing_inspect),
+                onclick: move |_| inspect.set(true),
+                { fl!("style-section-inspect") }
+            }
+        }
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/char_browser.rs b/loki-text/src/routes/editor/editor_style_editor/char_browser.rs
new file mode 100644
index 00000000..4401afa5
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/char_browser.rs
@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The character-styles list for the style panel's left column (Spec 05 M6
+//! character family). Extracted from `mod.rs` to keep it under the ceiling.
+//!
+//! Selecting a character style writes its id into `editing_char_style`, which the
+//! panel reads to show that style's read-only provenance inspector (§9). Editing
+//! character styles is a later increment — this pass browses and inspects them.
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::posture::StylePanelPosture;
+
+/// Renders the "Character styles" heading and one button per character style
+/// (empty when the document has none). `char_selected` highlights the active id;
+/// `posture` supplies the Compact touch minimum (§11).
+pub(super) fn char_list_section(
+    char_list: Vec<(String, String)>,
+    char_selected: Option<String>,
+    mut editing_char_style: Signal<Option<String>>,
+    posture: StylePanelPosture,
+) -> Element {
+    if char_list.is_empty() {
+        return rsx! {};
+    }
+    rsx! {
+        div {
+            style: format!(
+                "font-size: {fs}px; color: {fg}; margin-top: {mt}px; margin-bottom: 2px;",
+                fs = tokens::FONT_SIZE_XS,
+                fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                mt = tokens::SPACE_3,
+            ),
+            { fl!("style-char-family-heading") }
+        }
+        for (id, display) in char_list.into_iter() {
+            {
+                let is_sel = char_selected.as_deref() == Some(id.as_str());
+                let id_cap = id.clone();
+                rsx! {
+                    button {
+                        key: "char-{id}",
+                        style: format!(
+                            "text-align: left; padding: {p}px {p2}px; border-radius: 3px; {touch} \
+                             border: 1px solid {border}; cursor: pointer; font-family: {ff}; \
+                             font-size: {fs}px; background: {bg}; color: {fg};",
+                            p = tokens::SPACE_1,
+                            p2 = tokens::SPACE_2,
+                            touch = posture.touch_min_css(),
+                            border = if is_sel {
+                                tokens::COLOR_TAB_ACTIVE_INDICATOR
+                            } else {
+                                tokens::COLOR_BORDER_CHROME
+                            },
+                            ff = tokens::FONT_FAMILY_UI,
+                            fs = tokens::FONT_SIZE_LABEL,
+                            bg = if is_sel { tokens::COLOR_SURFACE_3 } else { tokens::COLOR_SURFACE_2 },
+                            fg = tokens::COLOR_TEXT_ON_CHROME,
+                        ),
+                        onclick: move |_| editing_char_style.set(Some(id_cap.clone())),
+                        "{display}"
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/family_inspector.rs b/loki-text/src/routes/editor/editor_style_editor/family_inspector.rs
new file mode 100644
index 00000000..3a4822f8
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/family_inspector.rs
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The right-hand read-only inspector columns for the non-paragraph families
+//! (Spec 05 M6 §9). Rendered to the right of the paragraph provenance column
+//! when a character or list style is selected in the left column.
+//!
+//! Factored out of `mod.rs` so the panel body stays under the ceiling and both
+//! family columns share one boundary. The character column reuses
+//! [`super::provenance::CharRowsSection`]; the list column is rendered here
+//! because list styles are non-inheriting (per-level rows, no provenance chip).
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::panel_data::{CharSelection, ListSelection};
+use super::posture::StylePanelPosture;
+use super::provenance::CharRowsSection;
+
+/// Renders the character and list read-only inspector columns, each present only
+/// when its family has a selection. Both sit to the right of the paragraph
+/// provenance column (or stack full-width beneath it at Compact, per `posture`).
+pub(super) fn family_inspector_columns(
+    char_selected_rows: CharSelection,
+    list_selected_rows: ListSelection,
+    posture: StylePanelPosture,
+) -> Element {
+    rsx! {
+        // ── Character inspector (read-only; §9 character family) ────────────
+        if let Some((name, rows)) = char_selected_rows {
+            div { style: column_style(posture), CharRowsSection { heading: name, rows } }
+        }
+
+        // ── List inspector (read-only; §9 list family, non-inheriting) ──────
+        if let Some((name, rows)) = list_selected_rows {
+            div {
+                style: column_style(posture),
+                div {
+                    style: format!(
+                        "font-size: {fs}px; font-weight: {fw}; color: {fg}; margin-bottom: {mb}px;",
+                        fs = tokens::FONT_SIZE_LABEL,
+                        fw = tokens::FONT_WEIGHT_MEDIUM,
+                        fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                        mb = tokens::SPACE_1,
+                    ),
+                    { name }
+                }
+                for lvl in rows.into_iter() {
+                    div {
+                        key: "list-level-{lvl.level}",
+                        style: format!("display: flex; flex-direction: column; margin-bottom: {}px;", tokens::SPACE_1),
+                        span {
+                            style: format!(
+                                "font-size: {fs}px; color: {fg}; font-weight: {fw};",
+                                fs = tokens::FONT_SIZE_LABEL,
+                                fg = tokens::COLOR_TEXT_ON_CHROME,
+                                fw = tokens::FONT_WEIGHT_SEMIBOLD,
+                            ),
+                            { fl!("style-list-level-label", n = lvl.level as i64) }
+                        }
+                        span {
+                            style: format!(
+                                "font-size: {fs}px; color: {fg};",
+                                fs = tokens::FONT_SIZE_XS,
+                                fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                            ),
+                            {
+                                fl!(
+                                    "style-list-level-detail",
+                                    label = lvl.label,
+                                    indent = lvl.indent,
+                                    hanging = lvl.hanging,
+                                    alignment = lvl.alignment
+                                )
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// The shared read-only column chrome (border + padding + scroll). 220px wide at
+/// Expanded; full-width when the panel stacks at Compact.
+fn column_style(posture: StylePanelPosture) -> String {
+    format!(
+        "width: {w}; min-width: {w}; overflow-y: auto; \
+         border-left: 1px solid {border}; padding: {p}px;",
+        w = posture.section_width(220.0),
+        border = tokens::COLOR_BORDER_CHROME,
+        p = tokens::SPACE_3,
+    )
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/form.rs b/loki-text/src/routes/editor/editor_style_editor/form.rs
index 6dcb1f6e..fdd296d2 100644
--- a/loki-text/src/routes/editor/editor_style_editor/form.rs
+++ b/loki-text/src/routes/editor/editor_style_editor/form.rs
@@ -14,9 +14,11 @@ use appthere_ui::tokens;
 use dioxus::prelude::*;
 use loki_i18n::fl;
 
+use loki_doc_model::style::StyleId;
+
 use super::super::editor_keydown_ctrl::post_mutation_sync;
 use super::super::editor_state::StyleDraft;
-use super::super::editor_style_catalog::commit_style_to_loro;
+use super::super::editor_style_catalog::{catalog_snapshot, commit_style_to_loro};
 use super::StyleEditorSync;
 use super::draft::draft_to_style;
 use super::form_font::{font_picker, input_style, label_style, weight_selector};
@@ -142,6 +144,9 @@ pub(super) fn style_form(
     sync: StyleEditorSync,
 ) -> Element {
     let ds_apply = Arc::clone(&doc_state);
+    let ds_delete = Arc::clone(&doc_state);
+    let can_delete = draft.is_custom;
+    let delete_id = draft.id.clone();
     let align_cur = draft.alignment.clone();
     rsx! {
         div {
@@ -214,6 +219,19 @@ pub(super) fn style_form(
                         let Some(draft_val) = editing_style_draft.read().clone() else {
                             return;
                         };
+                        // Guard re-parenting against cycles (Spec 05 §7): reject
+                        // an Apply whose based-on would make the tree non-acyclic.
+                        if !draft_val.parent.is_empty() {
+                            let child = StyleId::new(&draft_val.id);
+                            let new_parent = StyleId::new(&draft_val.parent);
+                            let cycles = catalog_snapshot(&ds_apply)
+                                .is_some_and(|cat| cat.para_reparent_cycles(&child, &new_parent));
+                            if cycles {
+                                let mut save_message = sync.save_message;
+                                save_message.set(Some(fl!("style-reparent-cycle")));
+                                return;
+                            }
+                        }
                         let style = draft_to_style(&draft_val);
                         // Persist through Loro then re-derive (which reads the
                         // catalog back from the CRDT) so the edit is durable and
@@ -241,6 +259,10 @@ pub(super) fn style_form(
                     },
                     { fl!("ribbon-style-apply-changes") }
                 }
+
+                // Delete — user styles only; built-in/default styles are
+                // protected (§8). Extracted to keep this file under the ceiling.
+                { super::actions::delete_button(can_delete, ds_delete, delete_id, editing_style_draft, sync) }
             }
         }
     }
diff --git a/loki-text/src/routes/editor/editor_style_editor/form_font.rs b/loki-text/src/routes/editor/editor_style_editor/form_font.rs
index c5c5f62d..bdd2cb54 100644
--- a/loki-text/src/routes/editor/editor_style_editor/form_font.rs
+++ b/loki-text/src/routes/editor/editor_style_editor/form_font.rs
@@ -30,8 +30,11 @@ fn weight_label(w: u16) -> String {
 /// Inline font-family picker: a text input that doubles as a substring filter
 /// over the available families, with a scrollable result list beneath it.
 ///
-/// COMPAT(dioxus-native): a native dropdown / `position: absolute` popover is
-/// unsupported in Blitz, so the candidate list renders inline below the input.
+/// The candidate list renders inline below the input rather than as an
+/// overlaid popover. Blitz has no native `<select>` dropdown; block-level
+/// `position: absolute` is now confirmed (CLAUDE.md), but an overlay anchored to
+/// this input sits in an *inline* formatting context, where absolute positioning
+/// is still unverified in Blitz — so the inline list stays for now.
 ///
 /// Touch targets: each family row is a full-width button; with 4px vertical
 /// padding inside the 84px scroll area the rows clear the 44×44 logical-pixel
diff --git a/loki-text/src/routes/editor/editor_style_editor/list_browser.rs b/loki-text/src/routes/editor/editor_style_editor/list_browser.rs
new file mode 100644
index 00000000..4e829457
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/list_browser.rs
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The list-styles list for the style panel's left column (Spec 05 M6 list
+//! family). Mirrors `char_browser` — a non-inheriting browse-and-inspect
+//! surface, kept in its own module to hold `mod.rs` under the ceiling.
+//!
+//! Selecting a list style writes its id into `editing_list_style`, which the
+//! panel reads to show that style's per-level rows read-only (§9). List styles
+//! are flat (no inheritance), so this is a plain sorted list, not a tree.
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use super::posture::StylePanelPosture;
+
+/// Renders the "List styles" heading and one button per list style (empty when
+/// the document has none). `list_selected` highlights the active id; `posture`
+/// supplies the Compact touch minimum (§11).
+pub(super) fn list_list_section(
+    list_list: Vec<(String, String)>,
+    list_selected: Option<String>,
+    mut editing_list_style: Signal<Option<String>>,
+    posture: StylePanelPosture,
+) -> Element {
+    if list_list.is_empty() {
+        return rsx! {};
+    }
+    rsx! {
+        div {
+            style: format!(
+                "font-size: {fs}px; color: {fg}; margin-top: {mt}px; margin-bottom: 2px;",
+                fs = tokens::FONT_SIZE_XS,
+                fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                mt = tokens::SPACE_3,
+            ),
+            { fl!("style-list-family-heading") }
+        }
+        for (id, display) in list_list.into_iter() {
+            {
+                let is_sel = list_selected.as_deref() == Some(id.as_str());
+                let id_cap = id.clone();
+                rsx! {
+                    button {
+                        key: "list-{id}",
+                        style: format!(
+                            "text-align: left; padding: {p}px {p2}px; border-radius: 3px; {touch} \
+                             border: 1px solid {border}; cursor: pointer; font-family: {ff}; \
+                             font-size: {fs}px; background: {bg}; color: {fg};",
+                            p = tokens::SPACE_1,
+                            p2 = tokens::SPACE_2,
+                            touch = posture.touch_min_css(),
+                            border = if is_sel {
+                                tokens::COLOR_TAB_ACTIVE_INDICATOR
+                            } else {
+                                tokens::COLOR_BORDER_CHROME
+                            },
+                            ff = tokens::FONT_FAMILY_UI,
+                            fs = tokens::FONT_SIZE_LABEL,
+                            bg = if is_sel { tokens::COLOR_SURFACE_3 } else { tokens::COLOR_SURFACE_2 },
+                            fg = tokens::COLOR_TEXT_ON_CHROME,
+                        ),
+                        onclick: move |_| editing_list_style.set(Some(id_cap.clone())),
+                        "{display}"
+                    }
+                }
+            }
+        }
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/mod.rs b/loki-text/src/routes/editor/editor_style_editor/mod.rs
index b1053db6..04d4ca80 100644
--- a/loki-text/src/routes/editor/editor_style_editor/mod.rs
+++ b/loki-text/src/routes/editor/editor_style_editor/mod.rs
@@ -8,21 +8,33 @@
 //! ([`form::style_form`]) edits the selected draft, which the Apply button
 //! commits to the catalog and relays out.
 
+mod actions;
+mod body;
+mod char_browser;
 mod draft;
+mod family_inspector;
 mod form;
 mod form_font;
+mod list_browser;
+mod panel_data;
+mod posture;
+mod provenance;
 
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 
+use appthere_ui::responsive::Breakpoint;
 use appthere_ui::tokens;
 use dioxus::prelude::*;
 use loki_i18n::fl;
 
+use super::editor_keydown_ctrl::post_mutation_sync;
 use super::editor_state::StyleDraft;
-use super::editor_style_catalog::{catalog_style_list, get_catalog_style, new_custom_style_id};
+use super::editor_style_catalog::{catalog_style_tree, get_catalog_style, reset_style_property};
 use crate::editing::cursor::CursorState;
-use crate::editing::state::DocumentState;
+use crate::editing::state::{DocumentState, apply_mutation_and_relayout};
+use posture::StylePanelPosture;
+use provenance::StyleProvenanceList;
 
 pub(super) use draft::style_to_draft;
 
@@ -44,15 +56,24 @@ pub(super) struct StyleEditorSync {
     pub can_undo: Signal<bool>,
     /// Whether redo is available.
     pub can_redo: Signal<bool>,
+    /// Status-banner sink for feedback (e.g. a rejected cyclic re-parent).
+    pub save_message: Signal<Option<String>>,
 }
 
 /// Renders the inline style catalog editor panel.
 ///
 /// Plain function — no hooks. `font_families` is enumerated once per editor
-/// (memoised by the caller) and threaded into the form's font picker.
+/// (memoised by the caller) and threaded into the form's font picker. The
+/// caller reads the breakpoint (this panel cannot host hooks) and passes it in;
+/// [`StylePanelPosture`] maps it to the Compact stacked-sheet layout (§11).
+#[allow(clippy::too_many_arguments)]
 pub(super) fn style_editor_panel(
     doc_state: Arc<Mutex<DocumentState>>,
     mut editing_style_draft: Signal<Option<StyleDraft>>,
+    editing_char_style: Signal<Option<String>>,
+    editing_list_style: Signal<Option<String>>,
+    style_panel_inspect: Signal<bool>,
+    breakpoint: Breakpoint,
     font_families: Rc<Vec<String>>,
     sync: StyleEditorSync,
 ) -> Element {
@@ -61,10 +82,39 @@ pub(super) fn style_editor_panel(
         None => return rsx! {},
     };
 
-    let styles = catalog_style_list(&doc_state);
+    let posture = StylePanelPosture::for_breakpoint(breakpoint);
+    // When stacked (Compact), the segmented switcher shows one group at a time;
+    // when side-by-side (Expanded/Medium), both groups are always visible.
+    let inspect = posture.stack && *style_panel_inspect.read();
+    let show_edit = !posture.stack || !inspect;
+    let show_inspect = !posture.stack || inspect;
+
+    // Family browsers (§9): the char/list style lists + the selected style's
+    // read-only rows. Selections live in `editing_char_style` / `editing_list_style`.
+    let char_selected = editing_char_style.read().clone();
+    let (char_list, char_selected_rows) =
+        panel_data::char_data(&doc_state, char_selected.as_deref());
+    let list_selected = editing_list_style.read().clone();
+    let (list_list, list_selected_rows) =
+        panel_data::list_data(&doc_state, list_selected.as_deref());
+
+    let styles = catalog_style_tree(&doc_state);
     let active_id = draft.id.clone();
-    let ds_list = Arc::clone(&doc_state);
-    let ds_new = Arc::clone(&doc_state);
+    let ds_left = Arc::clone(&doc_state);
+
+    // Everything the provenance column renders (staged rows, impact preview,
+    // new-style parent default, linked character-style rows) — see `panel_data`.
+    let panel_data::InspectorData {
+        display_rows,
+        impact_names,
+        new_style_parent,
+        linked,
+    } = panel_data::inspector_data(&doc_state, &draft);
+    // Handles for the reset-to-inherited action on locally-set inspector rows.
+    let ds_reset = Arc::clone(&doc_state);
+    let reset_id = draft.id.clone();
+    // Handle for the jump-to-ancestor link on inherited inspector rows.
+    let ds_jump = Arc::clone(&doc_state);
 
     rsx! {
         div {
@@ -72,7 +122,7 @@ pub(super) fn style_editor_panel(
                 "height: {h}px; min-height: {h}px; max-height: {h}px; \
                  display: flex; flex-direction: column; flex-shrink: 0; \
                  background: {bg}; border-top: 1px solid {border};",
-                h = STYLE_EDITOR_HEIGHT_PX,
+                h = posture.height_px,
                 bg = tokens::COLOR_SURFACE_1,
                 border = tokens::COLOR_BORDER_CHROME,
             ),
@@ -109,80 +159,84 @@ pub(super) fn style_editor_panel(
                 }
             }
 
-            // ── Two-column body ────────────────────────────────────────────────
+            // ── Compact-only Edit/Inspect switcher (§11) ───────────────────────
+            if posture.stack {
+                { body::section_switcher(style_panel_inspect) }
+            }
+
+            // ── Body: side-by-side columns at Expanded, stacked sheet at Compact
             div {
-                style: "display: flex; flex-direction: row; flex: 1; overflow: hidden;",
+                style: format!(
+                    "display: flex; flex-direction: {dir}; flex: 1; overflow-{ov};",
+                    dir = posture.body_direction(),
+                    ov = if posture.stack { "y: auto" } else { ": hidden" },
+                ),
 
-                // ── Left: catalog style list ───────────────────────────────────
-                div {
-                    style: format!(
-                        "width: 160px; min-width: 160px; overflow-y: auto; \
-                         border-right: 1px solid {border}; display: flex; \
-                         flex-direction: column; gap: 2px; padding: {p}px;",
-                        border = tokens::COLOR_BORDER_CHROME,
-                        p = tokens::SPACE_2,
-                    ),
+                // ── Left: catalog + family lists ───────────────────────────────
+                if show_edit {
+                    { body::left_column(
+                        ds_left,
+                        styles,
+                        active_id,
+                        editing_style_draft,
+                        new_style_parent,
+                        char_list,
+                        char_selected,
+                        editing_char_style,
+                        list_list,
+                        list_selected,
+                        editing_list_style,
+                        posture,
+                    ) }
+
+                    // ── Middle: edit form ──────────────────────────────────────
+                    { form::style_form(doc_state, editing_style_draft, draft, font_families, sync) }
+                }
 
-                    {styles.into_iter().map(|(id, display)| {
-                        let is_active = id == active_id;
-                        let ds_c = Arc::clone(&ds_list);
-                        let id_cap = id.clone();
-                        rsx! {
-                            button {
-                                key: "{id}",
-                                style: format!(
-                                    "text-align: left; padding: {p}px {p2}px; \
-                                     border-radius: 3px; border: 1px solid {border}; \
-                                     cursor: pointer; font-family: {ff}; \
-                                     font-size: {fs}px; background: {bg}; color: {fg};",
-                                    p = tokens::SPACE_1, p2 = tokens::SPACE_2,
-                                    border = if is_active { tokens::COLOR_TAB_ACTIVE_INDICATOR } else { tokens::COLOR_BORDER_CHROME },
-                                    ff = tokens::FONT_FAMILY_UI,
-                                    fs = tokens::FONT_SIZE_LABEL,
-                                    bg = if is_active { tokens::COLOR_SURFACE_3 } else { tokens::COLOR_SURFACE_2 },
-                                    fg = tokens::COLOR_TEXT_ON_CHROME,
-                                ),
-                                onclick: move |_| {
-                                    if let Some(s) = get_catalog_style(&ds_c, &id_cap) {
-                                        editing_style_draft.set(Some(style_to_draft(&s)));
-                                    }
-                                },
-                                "{display}"
+                // ── Right: provenance inspector (Spec 05 M2) ───────────────────
+                if show_inspect && !display_rows.is_empty() {
+                    StyleProvenanceList {
+                        rows: display_rows,
+                        impact: impact_names,
+                        linked,
+                        posture,
+                        on_reset: move |property| {
+                            {
+                                let ldoc_guard = sync.loro_doc.read();
+                                let Some(ldoc) = ldoc_guard.as_ref() else {
+                                    return;
+                                };
+                                reset_style_property(ldoc, &ds_reset, &reset_id, property);
+                                apply_mutation_and_relayout(&ds_reset, ldoc);
+                            }
+                            post_mutation_sync(
+                                &ds_reset,
+                                sync.loro_doc,
+                                sync.cursor_state,
+                                sync.undo_manager,
+                                sync.can_undo,
+                                sync.can_redo,
+                            );
+                            // Re-derive the draft so the form + inspector reflect
+                            // the reset (the cleared property now shows inherited).
+                            if let Some(updated) = get_catalog_style(&ds_reset, &reset_id) {
+                                editing_style_draft.set(Some(style_to_draft(&updated)));
+                            }
+                        },
+                        on_jump: move |ancestor: loki_doc_model::style::StyleId| {
+                            // Open the ancestor that sets an inherited property, so
+                            // the user can change it there for all dependents.
+                            if let Some(s) = get_catalog_style(&ds_jump, ancestor.as_str()) {
+                                editing_style_draft.set(Some(style_to_draft(&s)));
                             }
-                        }
-                    })}
-
-                    button {
-                        style: format!(
-                            "padding: {p}px {p2}px; border-radius: 3px; margin-top: {mt}px; \
-                             border: 1px solid {border}; cursor: pointer; \
-                             font-family: {ff}; font-size: {fs}px; \
-                             background: {bg}; color: {fg};",
-                            p = tokens::SPACE_1, p2 = tokens::SPACE_2,
-                            mt = tokens::SPACE_2,
-                            border = tokens::COLOR_BORDER_DEFAULT,
-                            ff = tokens::FONT_FAMILY_UI,
-                            fs = tokens::FONT_SIZE_LABEL,
-                            bg = tokens::COLOR_SURFACE_2,
-                            fg = tokens::COLOR_TEXT_ON_CHROME,
-                        ),
-                        aria_label: fl!("ribbon-style-new-aria"),
-                        onclick: move |_| {
-                            let new_id = new_custom_style_id(&ds_new);
-                            editing_style_draft.set(Some(StyleDraft {
-                                id: new_id.clone(),
-                                name: new_id,
-                                is_custom: true,
-                                alignment: "Left".to_string(),
-                                ..StyleDraft::default()
-                            }));
                         },
-                        { fl!("editor-style-new") }
                     }
                 }
 
-                // ── Right: edit form ───────────────────────────────────────────
-                { form::style_form(doc_state, editing_style_draft, draft, font_families, sync) }
+                // ── Right: character + list inspectors (read-only; §9) ─────────
+                if show_inspect {
+                    { family_inspector::family_inspector_columns(char_selected_rows, list_selected_rows, posture) }
+                }
             }
         }
     }
diff --git a/loki-text/src/routes/editor/editor_style_editor/panel_data.rs b/loki-text/src/routes/editor/editor_style_editor/panel_data.rs
new file mode 100644
index 00000000..f5c8ccaa
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/panel_data.rs
@@ -0,0 +1,187 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Pre-render inspector data for the style editor panel (Spec 05 M2/M4/M6).
+//!
+//! Extracted from `mod.rs` to keep that file under the 300-line ceiling. Given
+//! the editor's `doc_state` and the current draft, [`inspector_data`] computes
+//! everything the provenance column renders: the staged rows, the impact
+//! preview, the default parent for a new style, and — for the **linked** family
+//! (§9) — the paragraph style's linked character style rows.
+
+use std::sync::{Arc, Mutex};
+
+use loki_doc_model::style::StyleId;
+
+use super::super::editor_state::StyleDraft;
+use super::super::editor_style_catalog::catalog_snapshot;
+use super::super::style_char_inspector::character_inspector_rows;
+use super::super::style_impact::affected_dependents;
+use super::super::style_inspector::{InspectorRow, paragraph_inspector_rows};
+use super::super::style_list_inspector::{ListLevelRow, list_inspector_rows};
+use super::draft::draft_to_style;
+use crate::editing::state::DocumentState;
+
+/// Everything the provenance column needs, derived once per render.
+pub(super) struct InspectorData {
+    /// Paragraph rows previewing the pending draft; the flag is `true` when the
+    /// draft's uncommitted edit changes the row vs. the committed value (§12).
+    pub display_rows: Vec<(InspectorRow, bool)>,
+    /// Display names of dependents a staged change will also change (§7).
+    pub impact_names: Vec<String>,
+    /// Default parent for a new style — the current committed style, else empty.
+    pub new_style_parent: String,
+    /// The linked character style's `(display name, rows)`, when this paragraph
+    /// style links one and it exists (§9 linked family). Read-only.
+    pub linked: Option<(String, Vec<InspectorRow>)>,
+}
+
+pub(super) fn inspector_data(
+    doc_state: &Arc<Mutex<DocumentState>>,
+    draft: &StyleDraft,
+) -> InspectorData {
+    let sid = StyleId::new(&draft.id);
+    let committed_rows = catalog_snapshot(doc_state)
+        .map(|cat| paragraph_inspector_rows(&cat, &sid))
+        .unwrap_or_default();
+    let display_rows: Vec<(InspectorRow, bool)> = catalog_snapshot(doc_state)
+        .map(|mut cat| {
+            cat.paragraph_styles
+                .insert(sid.clone(), draft_to_style(draft));
+            paragraph_inspector_rows(&cat, &sid)
+        })
+        .unwrap_or_default()
+        .into_iter()
+        .map(|pending| {
+            let staged = committed_rows
+                .iter()
+                .find(|c| c.property == pending.property)
+                != Some(&pending);
+            (pending, staged)
+        })
+        .collect();
+
+    let changed: Vec<_> = display_rows
+        .iter()
+        .filter(|(_, staged)| *staged)
+        .map(|(row, _)| row.property)
+        .collect();
+    let impact_names: Vec<String> = catalog_snapshot(doc_state)
+        .map(|cat| {
+            affected_dependents(&cat, &sid, &changed)
+                .into_iter()
+                .map(|d| display_name_of(&cat, &d))
+                .collect()
+        })
+        .unwrap_or_default();
+
+    let new_style_parent = if committed_rows.is_empty() {
+        String::new()
+    } else {
+        draft.id.clone()
+    };
+
+    let linked = catalog_snapshot(doc_state).and_then(|cat| {
+        let lcs = cat.paragraph_styles.get(&sid)?.linked_char_style.clone()?;
+        let rows = character_inspector_rows(&cat, &lcs);
+        let name = cat
+            .character_styles
+            .get(&lcs)
+            .and_then(|s| s.display_name.clone())
+            .unwrap_or_else(|| lcs.as_str().to_string());
+        (!rows.is_empty()).then_some((name, rows))
+    });
+
+    InspectorData {
+        display_rows,
+        impact_names,
+        new_style_parent,
+        linked,
+    }
+}
+
+fn display_name_of(cat: &loki_doc_model::style::StyleCatalog, id: &StyleId) -> String {
+    cat.paragraph_styles
+        .get(id)
+        .and_then(|s| s.display_name.clone())
+        .unwrap_or_else(|| id.as_str().to_string())
+}
+
+/// A character style's `(id, display name)` pair for the family list.
+pub(super) type CharListEntry = (String, String);
+/// The selected character style's `(display name, rows)` for the inspector.
+pub(super) type CharSelection = Option<(String, Vec<InspectorRow>)>;
+
+/// The character-styles browser data (§9 character family): the `(id, display)`
+/// list sorted by display name, and — when `selected` names one — its
+/// `(display, rows)` for the read-only inspector.
+pub(super) fn char_data(
+    doc_state: &Arc<Mutex<DocumentState>>,
+    selected: Option<&str>,
+) -> (Vec<CharListEntry>, CharSelection) {
+    let Some(catalog) = catalog_snapshot(doc_state) else {
+        return (Vec::new(), None);
+    };
+    let mut list: Vec<(String, String)> = catalog
+        .character_styles
+        .iter()
+        .map(|(id, s)| {
+            let display = s
+                .display_name
+                .clone()
+                .unwrap_or_else(|| id.as_str().to_string());
+            (id.as_str().to_string(), display)
+        })
+        .collect();
+    list.sort_by(|(_, a), (_, b)| a.cmp(b));
+
+    let selected_rows = selected.and_then(|sel| {
+        let sid = StyleId::new(sel);
+        let rows = character_inspector_rows(&catalog, &sid);
+        let name = catalog
+            .character_styles
+            .get(&sid)
+            .and_then(|s| s.display_name.clone())
+            .unwrap_or_else(|| sel.to_string());
+        (!rows.is_empty()).then_some((name, rows))
+    });
+    (list, selected_rows)
+}
+
+/// The selected list style's `(display name, per-level rows)` for the inspector.
+pub(super) type ListSelection = Option<(String, Vec<ListLevelRow>)>;
+
+/// The list-styles browser data (§9 list family; non-inheriting): the
+/// `(id, display)` list sorted by display name, and — when `selected` names one
+/// — its flattened per-level rows for the read-only inspector.
+pub(super) fn list_data(
+    doc_state: &Arc<Mutex<DocumentState>>,
+    selected: Option<&str>,
+) -> (Vec<CharListEntry>, ListSelection) {
+    let Some(catalog) = catalog_snapshot(doc_state) else {
+        return (Vec::new(), None);
+    };
+    let mut list: Vec<CharListEntry> = catalog
+        .list_styles
+        .iter()
+        .map(|(id, s)| {
+            let display = s
+                .display_name
+                .clone()
+                .unwrap_or_else(|| id.as_str().to_string());
+            (id.as_str().to_string(), display)
+        })
+        .collect();
+    list.sort_by(|(_, a), (_, b)| a.cmp(b));
+
+    let selected_rows = selected.and_then(|sel| {
+        let lid = loki_doc_model::style::ListId::new(sel);
+        let rows = list_inspector_rows(&catalog, &lid);
+        let name = catalog
+            .list_styles
+            .get(&lid)
+            .and_then(|s| s.display_name.clone())
+            .unwrap_or_else(|| sel.to_string());
+        (!rows.is_empty()).then_some((name, rows))
+    });
+    (list, selected_rows)
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/posture.rs b/loki-text/src/routes/editor/editor_style_editor/posture.rs
new file mode 100644
index 00000000..4238b8ce
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/posture.rs
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Breakpoint-driven posture for the style editor panel (Spec 05 M7 / §11).
+//!
+//! At Expanded/Medium the panel is a wide, side-by-side surface (tree list +
+//! form + provenance + family inspectors). At Compact (< 600 px, Spec 03) there
+//! is no room beside the document, so it becomes a **full-width stacked sheet**
+//! with a segmented Edit/Inspect switch and ≥44 px touch targets. This is a pure
+//! `for_breakpoint` mapping so the posture is testable without a real window,
+//! mirroring [`appthere_ui::PanelPosture`].
+
+use appthere_ui::responsive::Breakpoint;
+use appthere_ui::tokens;
+
+/// Compact sheet height — taller than the Expanded side panel because the body
+/// stacks vertically (§11 full-surface posture).
+pub(super) const STYLE_PANEL_COMPACT_HEIGHT_PX: f32 = 520.0;
+
+/// The posture the style panel adopts for a size class.
+#[derive(Clone, Copy, Debug, PartialEq)]
+pub(super) struct StylePanelPosture {
+    /// Stack the body vertically (Compact sheet) instead of side-by-side columns.
+    pub stack: bool,
+    /// Each section fills the panel width instead of its fixed column width.
+    pub full_width: bool,
+    /// Minimum interactive height (logical px) for nav controls; 0 = natural.
+    pub min_touch_px: f32,
+    /// The panel's outer height in CSS pixels.
+    pub height_px: f32,
+}
+
+impl StylePanelPosture {
+    /// The posture for a size class.
+    #[must_use]
+    pub fn for_breakpoint(bp: Breakpoint) -> Self {
+        if bp.is_compact() {
+            Self {
+                stack: true,
+                full_width: true,
+                min_touch_px: tokens::TOUCH_MIN,
+                height_px: STYLE_PANEL_COMPACT_HEIGHT_PX,
+            }
+        } else {
+            Self {
+                stack: false,
+                full_width: false,
+                min_touch_px: 0.0,
+                height_px: super::STYLE_EDITOR_HEIGHT_PX,
+            }
+        }
+    }
+
+    /// The body's `flex-direction` (`column` when stacked, else `row`).
+    #[must_use]
+    pub fn body_direction(self) -> &'static str {
+        if self.stack { "column" } else { "row" }
+    }
+
+    /// The CSS `width` for a section that is fixed-width at Expanded: `100%` when
+    /// stacked, else `expanded_px`.
+    #[must_use]
+    pub fn section_width(self, expanded_px: f32) -> String {
+        if self.full_width {
+            "100%".to_string()
+        } else {
+            format!("{expanded_px}px")
+        }
+    }
+
+    /// A `min-height: Npx;` fragment for a touch target, empty when natural.
+    #[must_use]
+    pub fn touch_min_css(self) -> String {
+        if self.min_touch_px > 0.0 {
+            format!("min-height: {}px;", self.min_touch_px)
+        } else {
+            String::new()
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "posture_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/editor_style_editor/posture_tests.rs b/loki-text/src/routes/editor/editor_style_editor/posture_tests.rs
new file mode 100644
index 00000000..ba7883ea
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/posture_tests.rs
@@ -0,0 +1,39 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Style-panel posture (Spec 05 M7 / §11): the breakpoint → layout mapping,
+//! verified without a window (Spec 03 D1).
+
+use super::*;
+use appthere_ui::responsive::Breakpoint;
+
+#[test]
+fn compact_stacks_full_width_with_touch_targets() {
+    let p = StylePanelPosture::for_breakpoint(Breakpoint::Compact);
+    assert!(p.stack, "Compact stacks the body vertically");
+    assert!(p.full_width, "Compact sections fill the width");
+    assert_eq!(p.body_direction(), "column");
+    assert_eq!(p.section_width(160.0), "100%");
+    assert!(
+        p.min_touch_px >= 44.0,
+        "Compact meets the 44px touch minimum"
+    );
+    assert!(p.touch_min_css().contains("min-height"));
+    assert!(
+        p.height_px > super::super::STYLE_EDITOR_HEIGHT_PX,
+        "Compact sheet is taller than the Expanded side panel"
+    );
+}
+
+#[test]
+fn medium_and_expanded_keep_side_by_side_columns() {
+    for bp in [Breakpoint::Medium, Breakpoint::Expanded] {
+        let p = StylePanelPosture::for_breakpoint(bp);
+        assert!(!p.stack, "{bp:?} keeps side-by-side columns");
+        assert!(!p.full_width);
+        assert_eq!(p.body_direction(), "row");
+        assert_eq!(p.section_width(220.0), "220px");
+        assert_eq!(p.min_touch_px, 0.0, "{bp:?} uses natural control heights");
+        assert!(p.touch_min_css().is_empty());
+        assert_eq!(p.height_px, super::super::STYLE_EDITOR_HEIGHT_PX);
+    }
+}
diff --git a/loki-text/src/routes/editor/editor_style_editor/provenance.rs b/loki-text/src/routes/editor/editor_style_editor/provenance.rs
new file mode 100644
index 00000000..4dd4ade1
--- /dev/null
+++ b/loki-text/src/routes/editor/editor_style_editor/provenance.rs
@@ -0,0 +1,298 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Read-only resolved-vs-overridden inspector column (Spec 05 M2).
+//!
+//! [`StyleProvenanceList`] renders one line per applicable style property — its
+//! resolved value and where it comes from (Local / Inherited · ⟨ancestor⟩ /
+//! Default / Auto) — from the rows built by
+//! [`super::super::style_inspector::paragraph_inspector_rows`]. Every property
+//! appears, not just locally-set ones, so a user can see at a glance which
+//! properties this style *owns* versus passively receives (the fix for the old
+//! panel's local-only blindness). A `#[component]` (ADR-0013) taking a
+//! [`StylePanelPosture`] for its Compact width + touch targets (Spec 05 M7).
+
+use appthere_ui::tokens;
+use dioxus::prelude::*;
+use loki_i18n::fl;
+
+use loki_doc_model::style::StyleId;
+
+use super::super::style_inspector::{InspectorRow, RowProvenance, StyleProperty};
+use super::posture::StylePanelPosture;
+
+/// A linked character style shown alongside a paragraph style (§9 linked
+/// family): its display name and its resolved rows (read-only).
+pub(super) type LinkedRows = Option<(String, Vec<InspectorRow>)>;
+
+/// Renders the provenance inspector column for the selected style's rows.
+///
+/// Each row pairs an [`InspectorRow`] with a `staged` flag — `true` when the
+/// value reflects an uncommitted draft edit not yet applied (Spec 05 §12), shown
+/// with a pending marker.
+///
+/// `on_reset` is invoked with the property whose local override the user wants
+/// to clear (reset to inherited); the reset control appears only on rows that
+/// are set locally. `on_jump` is invoked with a source ancestor's id when the
+/// user clicks an *inherited* row's provenance chip — the jump-to-ancestor
+/// workflow ("identify where a property is set, change it for all dependents").
+#[component]
+pub(super) fn StyleProvenanceList(
+    rows: Vec<(InspectorRow, bool)>,
+    /// Display names of dependent styles that a staged change will also change
+    /// (Spec 05 §7 impact preview). Empty when nothing staged affects dependents.
+    impact: Vec<String>,
+    /// The paragraph style's linked character style, if any (§9 linked family).
+    linked: LinkedRows,
+    /// Breakpoint posture (Spec 05 M7): full-width + touch targets at Compact.
+    posture: StylePanelPosture,
+    on_reset: EventHandler<StyleProperty>,
+    on_jump: EventHandler<StyleId>,
+) -> Element {
+    rsx! {
+        div {
+            style: format!(
+                "width: {w}; min-width: {w}; overflow-y: auto; \
+                 border-left: 1px solid {border}; display: flex; \
+                 flex-direction: column; gap: {gap}px; padding: {p}px; \
+                 font-family: {ff};",
+                w = posture.section_width(220.0),
+                border = tokens::COLOR_BORDER_CHROME,
+                gap = tokens::SPACE_2,
+                p = tokens::SPACE_3,
+                ff = tokens::FONT_FAMILY_UI,
+            ),
+
+            div {
+                style: format!(
+                    "font-size: {fs}px; font-weight: {fw}; color: {fg}; \
+                     margin-bottom: {mb}px;",
+                    fs = tokens::FONT_SIZE_LABEL,
+                    fw = tokens::FONT_WEIGHT_MEDIUM,
+                    fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                    mb = tokens::SPACE_1,
+                ),
+                { fl!("style-inspector-heading") }
+            }
+
+            // Impact preview — dependents a staged change will also affect.
+            if !impact.is_empty() {
+                div {
+                    style: format!(
+                        "font-size: {fs}px; color: {fg}; background: {bg}; \
+                         border: 1px solid {border}; border-radius: {r}px; \
+                         padding: {p}px; margin-bottom: {mb}px;",
+                        fs = tokens::FONT_SIZE_XS,
+                        fg = tokens::COLOR_TEXT_ON_CHROME,
+                        bg = tokens::COLOR_SURFACE_2,
+                        border = tokens::COLOR_TAB_ACTIVE_INDICATOR,
+                        r = tokens::RADIUS_SM,
+                        p = tokens::SPACE_2,
+                        mb = tokens::SPACE_1,
+                    ),
+                    {
+                        fl!(
+                            "style-impact-preview",
+                            count = impact.len() as i64,
+                            names = impact.join(", ")
+                        )
+                    }
+                }
+            }
+
+            for (row, staged) in rows.iter() {
+                {
+                    let local = row.provenance.is_local();
+                    let staged = *staged;
+                    let property = row.property;
+                    // Inherited rows link to the ancestor that sets the value.
+                    let jump_target = match &row.provenance {
+                        RowProvenance::Inherited { ancestor_id, .. } => Some(ancestor_id.clone()),
+                        _ => None,
+                    };
+                    rsx! {
+                        div {
+                            key: "{row.property:?}",
+                            style: "display: flex; flex-direction: column;",
+
+                            // Property label (+ pending marker) and resolved value.
+                            div {
+                                style: "display: flex; justify-content: space-between; gap: 8px;",
+                                span {
+                                    style: format!(
+                                        "font-size: {fs}px; color: {fg}; font-weight: {fw};",
+                                        fs = tokens::FONT_SIZE_LABEL,
+                                        fg = tokens::COLOR_TEXT_ON_CHROME,
+                                        // Bold the properties this style actually owns.
+                                        fw = if local {
+                                            tokens::FONT_WEIGHT_SEMIBOLD
+                                        } else {
+                                            tokens::FONT_WEIGHT_REGULAR
+                                        },
+                                    ),
+                                    // Pending (uncommitted draft edit) marker.
+                                    if staged {
+                                        span {
+                                            style: format!("color: {};", tokens::COLOR_TAB_ACTIVE_INDICATOR),
+                                            title: fl!("style-staged-title"),
+                                            "\u{25CF} "
+                                        }
+                                    }
+                                    { property_label(row.property) }
+                                }
+                                span {
+                                    style: format!(
+                                        "font-size: {fs}px; color: {fg};",
+                                        fs = tokens::FONT_SIZE_LABEL,
+                                        fg = tokens::COLOR_TEXT_ON_CHROME,
+                                    ),
+                                    {
+                                        row.value_display
+                                            .clone()
+                                            .unwrap_or_else(|| fl!("style-inspector-unset"))
+                                    }
+                                }
+                            }
+
+                            // Provenance line — accented when local — plus a
+                            // reset-to-inherited control on locally-set rows.
+                            div {
+                                style: "display: flex; align-items: center; justify-content: space-between; gap: 8px;",
+                                // Inherited rows: the chip is a link to the source
+                                // ancestor. Other rows: a plain, accent-if-local chip.
+                                if let Some(target) = jump_target {
+                                    button {
+                                        style: format!(
+                                            "background: transparent; border: none; cursor: pointer; \
+                                             padding: 0; {touch} text-align: left; text-decoration: underline; \
+                                             font-family: {ff}; font-size: {fs}px; color: {fg};",
+                                            touch = posture.touch_min_css(),
+                                            ff = tokens::FONT_FAMILY_UI,
+                                            fs = tokens::FONT_SIZE_XS,
+                                            fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                                        ),
+                                        aria_label: fl!("style-jump-aria"),
+                                        onclick: move |_| on_jump.call(target.clone()),
+                                        { provenance_label(&row.provenance) }
+                                    }
+                                } else {
+                                    span {
+                                        style: format!(
+                                            "font-size: {fs}px; color: {fg};",
+                                            fs = tokens::FONT_SIZE_XS,
+                                            fg = if local {
+                                                tokens::COLOR_TAB_ACTIVE_INDICATOR
+                                            } else {
+                                                tokens::COLOR_TEXT_ON_CHROME_SECONDARY
+                                            },
+                                        ),
+                                        { provenance_label(&row.provenance) }
+                                    }
+                                }
+                                // Reset to inherited (local rows only). Compact
+                                // affordance in a dense inspector; the row's
+                                // click area carries the intent.
+                                if local {
+                                    button {
+                                        style: format!(
+                                            "background: transparent; border: none; cursor: pointer; \
+                                             padding: {p}px; {touch} font-size: {fs}px; color: {fg};",
+                                            p = tokens::SPACE_1,
+                                            touch = posture.touch_min_css(),
+                                            fs = tokens::FONT_SIZE_XS,
+                                            fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                                        ),
+                                        aria_label: fl!("style-reset-aria"),
+                                        onclick: move |_| on_reset.call(property),
+                                        "\u{21A9}"
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+
+            // Linked character style (§9 linked family) — read-only rows.
+            if let Some((name, rows)) = linked {
+                CharRowsSection { heading: fl!("style-linked-heading", name = name), rows }
+            }
+        }
+    }
+}
+
+/// A read-only block of character-property rows under a heading — used for the
+/// linked character style (§9) and the standalone character panel (§9 character
+/// family). Each row is property · resolved value · provenance.
+#[component]
+pub(super) fn CharRowsSection(heading: String, rows: Vec<InspectorRow>) -> Element {
+    rsx! {
+        div {
+            style: format!("margin-top: {}px;", tokens::SPACE_3),
+            div {
+                style: format!(
+                    "font-size: {fs}px; font-weight: {fw}; color: {fg}; margin-bottom: {mb}px;",
+                    fs = tokens::FONT_SIZE_LABEL,
+                    fw = tokens::FONT_WEIGHT_MEDIUM,
+                    fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                    mb = tokens::SPACE_1,
+                ),
+                { heading.clone() }
+            }
+            for lrow in rows.iter() {
+                div {
+                    key: "linked-{lrow.property:?}",
+                    style: "display: flex; justify-content: space-between; gap: 8px;",
+                    span {
+                        style: format!(
+                            "font-size: {fs}px; color: {fg};",
+                            fs = tokens::FONT_SIZE_LABEL, fg = tokens::COLOR_TEXT_ON_CHROME,
+                        ),
+                        { property_label(lrow.property) }
+                    }
+                    span {
+                        style: format!(
+                            "font-size: {fs}px; color: {fg};",
+                            fs = tokens::FONT_SIZE_XS, fg = tokens::COLOR_TEXT_ON_CHROME_SECONDARY,
+                        ),
+                        {
+                            let val = lrow.value_display.clone().unwrap_or_default();
+                            format!("{val} · {}", provenance_label(&lrow.provenance))
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+/// Localized label for a style property.
+fn property_label(property: StyleProperty) -> String {
+    match property {
+        StyleProperty::FontFamily => fl!("style-prop-font-family"),
+        StyleProperty::FontSize => fl!("style-prop-font-size"),
+        StyleProperty::Bold => fl!("style-prop-bold"),
+        StyleProperty::Italic => fl!("style-prop-italic"),
+        StyleProperty::Alignment => fl!("style-prop-alignment"),
+        StyleProperty::IndentStart => fl!("style-prop-indent-start"),
+        StyleProperty::IndentEnd => fl!("style-prop-indent-end"),
+        StyleProperty::IndentFirstLine => fl!("style-prop-indent-first-line"),
+        StyleProperty::SpaceBefore => fl!("style-prop-space-before"),
+        StyleProperty::SpaceAfter => fl!("style-prop-space-after"),
+        StyleProperty::LineHeight => fl!("style-prop-line-height"),
+    }
+}
+
+/// Localized provenance label; inherited rows name the source ancestor.
+fn provenance_label(provenance: &RowProvenance) -> String {
+    match provenance {
+        RowProvenance::Local => fl!("style-provenance-local"),
+        RowProvenance::Inherited {
+            ancestor_display, ..
+        } => fl!(
+            "style-provenance-inherited",
+            ancestor = ancestor_display.clone()
+        ),
+        RowProvenance::Default => fl!("style-provenance-default"),
+        RowProvenance::FormatDefault => fl!("style-provenance-engine"),
+    }
+}
diff --git a/loki-text/src/routes/editor/mod.rs b/loki-text/src/routes/editor/mod.rs
index 4158bd6f..fd2593b3 100644
--- a/loki-text/src/routes/editor/mod.rs
+++ b/loki-text/src/routes/editor/mod.rs
@@ -10,9 +10,13 @@
 //! All editing logic lives in [`editor_inner::EditorInner`].
 
 mod editor_canvas;
+mod editor_docked_panels;
 mod editor_error_view;
+mod editor_font_warning;
 mod editor_formatting;
 mod editor_inner;
+mod editor_insert;
+mod editor_insert_panel;
 mod editor_keydown;
 mod editor_keydown_ctrl;
 mod editor_language_panel;
@@ -23,9 +27,12 @@ mod editor_metadata_panel;
 mod editor_path_sync;
 mod editor_pointer;
 mod editor_publish;
+mod editor_responsive;
 mod editor_ribbon;
+mod editor_ribbon_insert;
 mod editor_save;
 mod editor_save_banner;
+mod editor_save_callbacks;
 mod editor_scrollbar;
 mod editor_spell;
 mod editor_spell_panel;
@@ -33,6 +40,10 @@ mod editor_state;
 mod editor_style;
 mod editor_style_catalog;
 mod editor_style_editor;
+mod style_char_inspector;
+mod style_impact;
+mod style_inspector;
+mod style_list_inspector;
 
 use dioxus::prelude::*;
 use editor_inner::EditorInner;
diff --git a/loki-text/src/routes/editor/style_char_inspector.rs b/loki-text/src/routes/editor/style_char_inspector.rs
new file mode 100644
index 00000000..569d6a62
--- /dev/null
+++ b/loki-text/src/routes/editor/style_char_inspector.rs
@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The resolved-vs-overridden inspector model for **character styles**
+//! (Spec 05 M6 — the character family).
+//!
+//! Mirrors [`super::style_inspector::paragraph_inspector_rows`] but resolves a
+//! standalone [`CharacterStyle`]'s own inheritance chain via
+//! `loki_doc_model`'s `resolve_char_chain` (the standalone-character resolver
+//! the collapsing `resolve_char` never provided — audit SM-2). It emits the same
+//! [`InspectorRow`] shape the paragraph family uses, so the provenance view and
+//! reset/jump affordances are shared across families — the "uniform inspector"
+//! Spec 05 §9 requires. Character styles carry only character properties, so the
+//! row set is font family / size / bold / italic.
+
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::{CharacterStyle, Provenance, StyleCatalog, StyleId};
+
+use super::style_inspector::{InspectorRow, RowProvenance, StyleProperty};
+
+/// Builds the inspector rows for the character style `id`, in display order.
+///
+/// Every applicable character property appears with its resolved value and
+/// provenance (Local / Inherited-from / FormatDefault; the character family has
+/// no document default). Returns an empty vector when `id` is not a character
+/// style in the catalog.
+#[must_use]
+pub fn character_inspector_rows(catalog: &StyleCatalog, id: &StyleId) -> Vec<InspectorRow> {
+    if !catalog.character_styles.contains_key(id) {
+        return Vec::new();
+    }
+    [
+        build_row(
+            catalog,
+            id,
+            StyleProperty::FontFamily,
+            |s| s.char_props.font_name.clone(),
+            fmt_string,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::FontSize,
+            |s| s.char_props.font_size,
+            fmt_points,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::Bold,
+            |s| s.char_props.bold,
+            fmt_bool,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::Italic,
+            |s| s.char_props.italic,
+            fmt_bool,
+        ),
+    ]
+    .into_iter()
+    .flatten()
+    .collect()
+}
+
+fn build_row<T: Clone>(
+    catalog: &StyleCatalog,
+    id: &StyleId,
+    property: StyleProperty,
+    get: impl Fn(&CharacterStyle) -> Option<T>,
+    fmt: impl Fn(&T) -> String,
+) -> Option<InspectorRow> {
+    let resolved = catalog.resolve_char_chain(id, get)?;
+    Some(InspectorRow {
+        property,
+        value_display: resolved.value.as_ref().map(fmt),
+        provenance: to_row_provenance(catalog, resolved.provenance),
+    })
+}
+
+/// Maps model provenance to display-ready provenance, resolving an inherited
+/// ancestor's display name from the **character** style map.
+fn to_row_provenance(catalog: &StyleCatalog, p: Provenance) -> RowProvenance {
+    match p {
+        Provenance::Local => RowProvenance::Local,
+        Provenance::Inherited(ancestor_id) => {
+            let ancestor_display = catalog
+                .character_styles
+                .get(&ancestor_id)
+                .and_then(|s| s.display_name.clone())
+                .unwrap_or_else(|| ancestor_id.as_str().to_string());
+            RowProvenance::Inherited {
+                ancestor_id,
+                ancestor_display,
+            }
+        }
+        Provenance::Default => RowProvenance::Default,
+        Provenance::FormatDefault => RowProvenance::FormatDefault,
+    }
+}
+
+// ── Value formatters (character subset) ─────────────────────────────────────
+
+// `&String` is required to satisfy the generic `fmt: Fn(&T)` bound (T = String).
+#[allow(clippy::ptr_arg)]
+fn fmt_string(s: &String) -> String {
+    s.clone()
+}
+
+fn fmt_points(p: &Points) -> String {
+    format!("{:.0} pt", p.value())
+}
+
+fn fmt_bool(b: &bool) -> String {
+    if *b {
+        "On".to_string()
+    } else {
+        "Off".to_string()
+    }
+}
+
+#[cfg(test)]
+#[path = "style_char_inspector_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/style_char_inspector_tests.rs b/loki-text/src/routes/editor/style_char_inspector_tests.rs
new file mode 100644
index 00000000..5a077525
--- /dev/null
+++ b/loki-text/src/routes/editor/style_char_inspector_tests.rs
@@ -0,0 +1,96 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Character-style inspector rows (Spec 05 M6): every character property with
+//! provenance, resolved over the character family's own inheritance chain.
+
+use super::*;
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::CharacterStyle;
+use loki_doc_model::style::props::char_props::CharProps;
+
+fn char_style(id: &str, parent: Option<&str>, cp: CharProps) -> CharacterStyle {
+    CharacterStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        char_props: cp,
+        extensions: Default::default(),
+    }
+}
+
+fn named(mut s: CharacterStyle, display: &str) -> CharacterStyle {
+    s.display_name = Some(display.to_string());
+    s
+}
+
+fn insert(cat: &mut StyleCatalog, s: CharacterStyle) {
+    cat.character_styles.insert(s.id.clone(), s);
+}
+
+fn row<'a>(rows: &'a [InspectorRow], p: StyleProperty) -> &'a InspectorRow {
+    rows.iter()
+        .find(|r| r.property == p)
+        .unwrap_or_else(|| panic!("missing row for {p:?}"))
+}
+
+#[test]
+fn lists_the_four_character_properties() {
+    let mut cat = StyleCatalog::new();
+    insert(&mut cat, char_style("Plain", None, CharProps::default()));
+    let rows = character_inspector_rows(&cat, &StyleId::new("Plain"));
+    assert_eq!(rows.len(), 4);
+    // A wholly unset property is FormatDefault with no value.
+    let bold = row(&rows, StyleProperty::Bold);
+    assert_eq!(bold.provenance, RowProvenance::FormatDefault);
+    assert_eq!(bold.value_display, None);
+}
+
+#[test]
+fn local_character_property_is_marked_local() {
+    let mut cat = StyleCatalog::new();
+    let cp = CharProps {
+        italic: Some(true),
+        ..Default::default()
+    };
+    insert(&mut cat, char_style("Emph", None, cp));
+    let rows = character_inspector_rows(&cat, &StyleId::new("Emph"));
+    let italic = row(&rows, StyleProperty::Italic);
+    assert!(italic.provenance.is_local());
+    assert_eq!(italic.value_display.as_deref(), Some("On"));
+}
+
+#[test]
+fn inherited_character_property_names_its_ancestor() {
+    let mut cat = StyleCatalog::new();
+    let base = CharProps {
+        bold: Some(true),
+        font_size: Some(Points::new(11.0)),
+        ..Default::default()
+    };
+    insert(&mut cat, named(char_style("Emph", None, base), "Emphasis"));
+    insert(
+        &mut cat,
+        char_style("Strong", Some("Emph"), CharProps::default()),
+    );
+    let rows = character_inspector_rows(&cat, &StyleId::new("Strong"));
+
+    let bold = row(&rows, StyleProperty::Bold);
+    assert_eq!(
+        bold.provenance,
+        RowProvenance::Inherited {
+            ancestor_id: StyleId::new("Emph"),
+            ancestor_display: "Emphasis".to_string(),
+        }
+    );
+    assert_eq!(bold.value_display.as_deref(), Some("On"));
+    assert_eq!(
+        row(&rows, StyleProperty::FontSize).value_display.as_deref(),
+        Some("11 pt")
+    );
+}
+
+#[test]
+fn unknown_character_style_yields_no_rows() {
+    let cat = StyleCatalog::new();
+    assert!(character_inspector_rows(&cat, &StyleId::new("Ghost")).is_empty());
+}
diff --git a/loki-text/src/routes/editor/style_impact.rs b/loki-text/src/routes/editor/style_impact.rs
new file mode 100644
index 00000000..0b7e9365
--- /dev/null
+++ b/loki-text/src/routes/editor/style_impact.rs
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Impact preview for staged style edits (Spec 05 M4 / §7).
+//!
+//! Before Apply, the panel shows *which* dependent styles a change to the edited
+//! style will also change — no surprise cascades. Given the set of properties
+//! being changed on a style, [`affected_dependents`] unions the exact dependent
+//! sets from `loki_doc_model`'s [`StyleCatalog::dependents_affected`] (which
+//! excludes dependents shadowed by a closer override).
+
+use std::collections::HashSet;
+
+use loki_doc_model::style::{ParagraphStyle, StyleCatalog, StyleId};
+
+use super::style_inspector::StyleProperty;
+
+/// Whether `property` is set locally on `style` — the shadowing test the impact
+/// walk uses (mirrors the property↔field mapping of `clear_local_property`).
+fn property_is_set(style: &ParagraphStyle, property: StyleProperty) -> bool {
+    let pp = &style.para_props;
+    let cp = &style.char_props;
+    match property {
+        StyleProperty::FontFamily => cp.font_name.is_some(),
+        StyleProperty::FontSize => cp.font_size.is_some(),
+        StyleProperty::Bold => cp.bold.is_some(),
+        StyleProperty::Italic => cp.italic.is_some(),
+        StyleProperty::Alignment => pp.alignment.is_some(),
+        StyleProperty::IndentStart => pp.indent_start.is_some(),
+        StyleProperty::IndentEnd => pp.indent_end.is_some(),
+        StyleProperty::IndentFirstLine => pp.indent_first_line.is_some(),
+        StyleProperty::SpaceBefore => pp.space_before.is_some(),
+        StyleProperty::SpaceAfter => pp.space_after.is_some(),
+        StyleProperty::LineHeight => pp.line_height.is_some(),
+    }
+}
+
+/// The dependent styles of `id` whose resolved value would change if the given
+/// `changed` properties were applied — deduplicated, in first-seen order.
+///
+/// Empty when nothing is staged or no dependent inherits a changed property.
+#[must_use]
+pub fn affected_dependents(
+    catalog: &StyleCatalog,
+    id: &StyleId,
+    changed: &[StyleProperty],
+) -> Vec<StyleId> {
+    let mut seen = HashSet::new();
+    let mut out = Vec::new();
+    for &property in changed {
+        for dependent in catalog.dependents_affected(id, |s| property_is_set(s, property)) {
+            if seen.insert(dependent.clone()) {
+                out.push(dependent);
+            }
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+#[path = "style_impact_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/style_impact_tests.rs b/loki-text/src/routes/editor/style_impact_tests.rs
new file mode 100644
index 00000000..be3e2140
--- /dev/null
+++ b/loki-text/src/routes/editor/style_impact_tests.rs
@@ -0,0 +1,93 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Impact preview (Spec 05 M4): the union of dependents affected by staged edits.
+
+use super::*;
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::ParagraphStyle;
+use loki_doc_model::style::props::char_props::CharProps;
+use loki_doc_model::style::props::para_props::{ParaProps, ParagraphAlignment};
+
+fn para(id: &str, parent: Option<&str>, pp: ParaProps, cp: CharProps) -> ParagraphStyle {
+    ParagraphStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        linked_char_style: None,
+        next_style_id: None,
+        para_props: pp,
+        char_props: cp,
+        is_default: false,
+        is_custom: false,
+        extensions: Default::default(),
+    }
+}
+
+fn insert(cat: &mut StyleCatalog, s: ParagraphStyle) {
+    cat.paragraph_styles.insert(s.id.clone(), s);
+}
+
+fn ids(v: &[StyleId]) -> Vec<&str> {
+    v.iter().map(StyleId::as_str).collect()
+}
+
+/// A(align+size) → { B, C(align override), D under B }
+fn catalog() -> StyleCatalog {
+    let mut c = StyleCatalog::new();
+    let a_pp = ParaProps {
+        alignment: Some(ParagraphAlignment::Left),
+        ..Default::default()
+    };
+    let a_cp = CharProps {
+        font_size: Some(Points::new(12.0)),
+        ..Default::default()
+    };
+    insert(&mut c, para("A", None, a_pp, a_cp));
+    insert(
+        &mut c,
+        para("B", Some("A"), ParaProps::default(), CharProps::default()),
+    );
+    let c_pp = ParaProps {
+        alignment: Some(ParagraphAlignment::Right),
+        ..Default::default()
+    };
+    insert(&mut c, para("C", Some("A"), c_pp, CharProps::default()));
+    insert(
+        &mut c,
+        para("D", Some("B"), ParaProps::default(), CharProps::default()),
+    );
+    c
+}
+
+#[test]
+fn nothing_staged_means_no_impact() {
+    let c = catalog();
+    assert!(affected_dependents(&c, &StyleId::new("A"), &[]).is_empty());
+}
+
+#[test]
+fn alignment_change_affects_inheriting_dependents_only() {
+    let c = catalog();
+    // C overrides alignment, so only B and D are affected.
+    let affected = affected_dependents(&c, &StyleId::new("A"), &[StyleProperty::Alignment]);
+    assert_eq!(ids(&affected), vec!["B", "D"]);
+}
+
+#[test]
+fn multiple_changed_properties_are_unioned_without_duplicates() {
+    let c = catalog();
+    // FontSize is inherited by B, C, and D (none override it); alignment by B, D.
+    // The union is B, C, D with no repeats.
+    let affected = affected_dependents(
+        &c,
+        &StyleId::new("A"),
+        &[StyleProperty::Alignment, StyleProperty::FontSize],
+    );
+    assert_eq!(ids(&affected), vec!["B", "D", "C"]);
+}
+
+#[test]
+fn leaf_style_has_no_dependents() {
+    let c = catalog();
+    assert!(affected_dependents(&c, &StyleId::new("D"), &[StyleProperty::Alignment]).is_empty());
+}
diff --git a/loki-text/src/routes/editor/style_inspector.rs b/loki-text/src/routes/editor/style_inspector.rs
new file mode 100644
index 00000000..83f86480
--- /dev/null
+++ b/loki-text/src/routes/editor/style_inspector.rs
@@ -0,0 +1,293 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The resolved-vs-overridden inspector model (Spec 05 M2).
+//!
+//! The old style editor showed only a style's *locally set* fields, so everything
+//! inherited was invisible (audit SM-3 — "local-only blindness"). This module
+//! builds, from the `loki_doc_model` provenance resolver (Spec 05 M1), one
+//! [`InspectorRow`] per *applicable* property — set locally, inherited from a
+//! named ancestor, supplied by the document default, or an engine fallback — each
+//! carrying its resolved value and where it comes from. The rendering layer maps
+//! [`StyleProperty`] to a localized label and an edit control; this model is
+//! pure and i18n-free, so it is unit-testable without a UI.
+//!
+//! Provenance names the source ancestor by its **display name** (falling back to
+//! the stable id), while keeping the ancestor's [`StyleId`] for the
+//! jump-to-ancestor affordance — display-name UI over id operations.
+
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::props::para_props::{LineHeight, ParagraphAlignment, Spacing};
+use loki_doc_model::style::{ParagraphStyle, Provenance, StyleCatalog, StyleId};
+
+/// Which property an [`InspectorRow`] describes. The rendering layer maps this to
+/// a localized label and the appropriate edit control.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum StyleProperty {
+    /// Run-default font family (character aspect of a paragraph style).
+    FontFamily,
+    /// Run-default font size.
+    FontSize,
+    /// Run-default bold.
+    Bold,
+    /// Run-default italic.
+    Italic,
+    /// Paragraph alignment.
+    Alignment,
+    /// Start-edge indent.
+    IndentStart,
+    /// End-edge indent.
+    IndentEnd,
+    /// First-line indent.
+    IndentFirstLine,
+    /// Space before the paragraph.
+    SpaceBefore,
+    /// Space after the paragraph.
+    SpaceAfter,
+    /// Line height.
+    LineHeight,
+}
+
+/// Where a row's value comes from, ready for display.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RowProvenance {
+    /// Set on the inspected style itself (an override; resettable).
+    Local,
+    /// Inherited from a named ancestor in the style's `parent` chain.
+    Inherited {
+        /// The ancestor's stable id (for the jump-to-ancestor affordance).
+        ancestor_id: StyleId,
+        /// The ancestor's display name (falls back to the id when unnamed).
+        ancestor_display: String,
+    },
+    /// Supplied by the document default style (docDefaults fall-through).
+    Default,
+    /// Unset everywhere; the rendering engine supplies the value.
+    FormatDefault,
+}
+
+impl RowProvenance {
+    /// `true` when the value is set on the inspected style itself.
+    #[must_use]
+    pub fn is_local(&self) -> bool {
+        matches!(self, RowProvenance::Local)
+    }
+}
+
+/// One inspector row: a property, its resolved value (display string), and its
+/// provenance.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct InspectorRow {
+    /// Which property this row edits.
+    pub property: StyleProperty,
+    /// The resolved value formatted for display; `None` when unset everywhere
+    /// (a `FormatDefault` row — the engine decides).
+    pub value_display: Option<String>,
+    /// Where the value comes from.
+    pub provenance: RowProvenance,
+}
+
+/// Builds the inspector rows for the paragraph style `id`, in display order.
+///
+/// Every applicable property appears, regardless of whether it is set locally —
+/// the fix for the old panel's local-only blindness. Returns an empty vector when
+/// `id` is not a paragraph style in the catalog.
+#[must_use]
+pub fn paragraph_inspector_rows(catalog: &StyleCatalog, id: &StyleId) -> Vec<InspectorRow> {
+    if !catalog.paragraph_styles.contains_key(id) {
+        return Vec::new();
+    }
+    [
+        build_row(
+            catalog,
+            id,
+            StyleProperty::FontFamily,
+            |s| s.char_props.font_name.clone(),
+            fmt_string,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::FontSize,
+            |s| s.char_props.font_size,
+            fmt_points,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::Bold,
+            |s| s.char_props.bold,
+            fmt_bool,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::Italic,
+            |s| s.char_props.italic,
+            fmt_bool,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::Alignment,
+            |s| s.para_props.alignment,
+            fmt_alignment,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::IndentStart,
+            |s| s.para_props.indent_start,
+            fmt_points,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::IndentEnd,
+            |s| s.para_props.indent_end,
+            fmt_points,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::IndentFirstLine,
+            |s| s.para_props.indent_first_line,
+            fmt_points,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::SpaceBefore,
+            |s| s.para_props.space_before,
+            fmt_spacing,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::SpaceAfter,
+            |s| s.para_props.space_after,
+            fmt_spacing,
+        ),
+        build_row(
+            catalog,
+            id,
+            StyleProperty::LineHeight,
+            |s| s.para_props.line_height,
+            fmt_line_height,
+        ),
+    ]
+    .into_iter()
+    .flatten()
+    .collect()
+}
+
+/// Resolves one property with provenance and formats its value into a row.
+fn build_row<T: Clone>(
+    catalog: &StyleCatalog,
+    id: &StyleId,
+    property: StyleProperty,
+    get: impl Fn(&ParagraphStyle) -> Option<T>,
+    fmt: impl Fn(&T) -> String,
+) -> Option<InspectorRow> {
+    let resolved = catalog.resolve_para_chain(id, get)?;
+    Some(InspectorRow {
+        property,
+        value_display: resolved.value.as_ref().map(fmt),
+        provenance: to_row_provenance(catalog, resolved.provenance),
+    })
+}
+
+/// Maps model [`Provenance`] to display-ready [`RowProvenance`], resolving an
+/// inherited ancestor's display name (falling back to its id).
+fn to_row_provenance(catalog: &StyleCatalog, p: Provenance) -> RowProvenance {
+    match p {
+        Provenance::Local => RowProvenance::Local,
+        Provenance::Inherited(ancestor_id) => {
+            let ancestor_display = catalog
+                .paragraph_styles
+                .get(&ancestor_id)
+                .and_then(|s| s.display_name.clone())
+                .unwrap_or_else(|| ancestor_id.as_str().to_string());
+            RowProvenance::Inherited {
+                ancestor_id,
+                ancestor_display,
+            }
+        }
+        Provenance::Default => RowProvenance::Default,
+        Provenance::FormatDefault => RowProvenance::FormatDefault,
+    }
+}
+
+/// Clears the local override of `property` on `style`, so the property falls
+/// through to its inherited / default / engine value on the next resolution —
+/// the "reset to inherited" action (Spec 05 §6). A no-op when the property was
+/// not set locally.
+pub fn clear_local_property(style: &mut ParagraphStyle, property: StyleProperty) {
+    let pp = &mut style.para_props;
+    let cp = &mut style.char_props;
+    match property {
+        StyleProperty::FontFamily => cp.font_name = None,
+        StyleProperty::FontSize => cp.font_size = None,
+        StyleProperty::Bold => cp.bold = None,
+        StyleProperty::Italic => cp.italic = None,
+        StyleProperty::Alignment => pp.alignment = None,
+        StyleProperty::IndentStart => pp.indent_start = None,
+        StyleProperty::IndentEnd => pp.indent_end = None,
+        StyleProperty::IndentFirstLine => pp.indent_first_line = None,
+        StyleProperty::SpaceBefore => pp.space_before = None,
+        StyleProperty::SpaceAfter => pp.space_after = None,
+        StyleProperty::LineHeight => pp.line_height = None,
+    }
+}
+
+// ── Value formatters ──────────────────────────────────────────────────────────
+
+// Must take `&String` (not `&str`) to satisfy the generic `fmt: Fn(&T) -> String`
+// bound in `build_row`, where `T = String` for the font-family row.
+#[allow(clippy::ptr_arg)]
+fn fmt_string(s: &String) -> String {
+    s.clone()
+}
+
+fn fmt_points(p: &Points) -> String {
+    format!("{:.0} pt", p.value())
+}
+
+fn fmt_bool(b: &bool) -> String {
+    if *b {
+        "On".to_string()
+    } else {
+        "Off".to_string()
+    }
+}
+
+fn fmt_alignment(a: &ParagraphAlignment) -> String {
+    match a {
+        ParagraphAlignment::Left => "Left",
+        ParagraphAlignment::Right => "Right",
+        ParagraphAlignment::Center => "Center",
+        ParagraphAlignment::Justify => "Justify",
+        ParagraphAlignment::Distribute => "Distribute",
+        _ => "—",
+    }
+    .to_string()
+}
+
+fn fmt_spacing(s: &Spacing) -> String {
+    match s {
+        Spacing::Exact(pt) => format!("{:.0} pt", pt.value()),
+        other => format!("{other:?}"),
+    }
+}
+
+fn fmt_line_height(l: &LineHeight) -> String {
+    match l {
+        LineHeight::Multiple(ratio) => format!("{ratio:.2}×"),
+        LineHeight::Exact(pt) => format!("{:.0} pt", pt.value()),
+        LineHeight::AtLeast(pt) => format!("≥ {:.0} pt", pt.value()),
+        other => format!("{other:?}"),
+    }
+}
+
+#[cfg(test)]
+#[path = "style_inspector_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/style_inspector_tests.rs b/loki-text/src/routes/editor/style_inspector_tests.rs
new file mode 100644
index 00000000..b12e4a3f
--- /dev/null
+++ b/loki-text/src/routes/editor/style_inspector_tests.rs
@@ -0,0 +1,308 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! Inspector-row model (Spec 05 M2): every applicable property appears with its
+//! resolved value and provenance — the fix for the old panel's local-only
+//! blindness — and inherited rows name their source ancestor by display name.
+
+use super::*;
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::ParagraphStyle;
+use loki_doc_model::style::props::char_props::CharProps;
+use loki_doc_model::style::props::para_props::{ParaProps, ParagraphAlignment};
+
+fn para(id: &str, parent: Option<&str>, pp: ParaProps, cp: CharProps) -> ParagraphStyle {
+    ParagraphStyle {
+        id: StyleId::new(id),
+        display_name: None,
+        parent: parent.map(StyleId::new),
+        linked_char_style: None,
+        next_style_id: None,
+        para_props: pp,
+        char_props: cp,
+        is_default: false,
+        is_custom: false,
+        extensions: Default::default(),
+    }
+}
+
+fn named(mut s: ParagraphStyle, display: &str) -> ParagraphStyle {
+    s.display_name = Some(display.to_string());
+    s
+}
+
+fn insert(cat: &mut StyleCatalog, s: ParagraphStyle) {
+    cat.paragraph_styles.insert(s.id.clone(), s);
+}
+
+fn row<'a>(rows: &'a [InspectorRow], p: StyleProperty) -> &'a InspectorRow {
+    rows.iter()
+        .find(|r| r.property == p)
+        .unwrap_or_else(|| panic!("missing row for {p:?}"))
+}
+
+#[test]
+fn lists_every_applicable_property_even_when_unset() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        insert(
+            &mut c,
+            para("Body", None, ParaProps::default(), CharProps::default()),
+        );
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Body"));
+    // All 11 modelled properties appear, not just the (zero) locally-set ones —
+    // this is the fix for the local-only blindness.
+    assert_eq!(rows.len(), 11);
+    // A wholly unset property is FormatDefault with no value.
+    let a = row(&rows, StyleProperty::Alignment);
+    assert_eq!(a.provenance, RowProvenance::FormatDefault);
+    assert_eq!(a.value_display, None);
+}
+
+#[test]
+fn local_property_is_marked_local_with_value() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        let pp = ParaProps {
+            alignment: Some(ParagraphAlignment::Center),
+            ..Default::default()
+        };
+        insert(&mut c, para("Body", None, pp, CharProps::default()));
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Body"));
+    let a = row(&rows, StyleProperty::Alignment);
+    assert!(a.provenance.is_local());
+    assert_eq!(a.value_display.as_deref(), Some("Center"));
+}
+
+#[test]
+fn inherited_row_names_its_ancestor_by_display_name() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        let base_pp = ParaProps {
+            alignment: Some(ParagraphAlignment::Justify),
+            ..Default::default()
+        };
+        // The ancestor has id "Heading1" but display name "Heading 1".
+        insert(
+            &mut c,
+            named(
+                para("Heading1", None, base_pp, CharProps::default()),
+                "Heading 1",
+            ),
+        );
+        insert(
+            &mut c,
+            para(
+                "Subhead",
+                Some("Heading1"),
+                ParaProps::default(),
+                CharProps::default(),
+            ),
+        );
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Subhead"));
+    let a = row(&rows, StyleProperty::Alignment);
+    match &a.provenance {
+        RowProvenance::Inherited {
+            ancestor_id,
+            ancestor_display,
+        } => {
+            assert_eq!(ancestor_id, &StyleId::new("Heading1")); // stable id for jump-to-ancestor
+            assert_eq!(ancestor_display, "Heading 1"); // display name for the UI
+        }
+        other => panic!("expected Inherited, got {other:?}"),
+    }
+    assert_eq!(a.value_display.as_deref(), Some("Justify"));
+    assert!(!a.provenance.is_local());
+}
+
+#[test]
+fn inherited_ancestor_without_display_name_falls_back_to_id() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        let base_cp = CharProps {
+            bold: Some(true),
+            ..Default::default()
+        };
+        insert(
+            &mut c,
+            para("Strongish", None, ParaProps::default(), base_cp),
+        ); // no display_name
+        insert(
+            &mut c,
+            para(
+                "Child",
+                Some("Strongish"),
+                ParaProps::default(),
+                CharProps::default(),
+            ),
+        );
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Child"));
+    let b = row(&rows, StyleProperty::Bold);
+    match &b.provenance {
+        RowProvenance::Inherited {
+            ancestor_display, ..
+        } => {
+            assert_eq!(ancestor_display, "Strongish"); // fell back to the id
+        }
+        other => panic!("expected Inherited, got {other:?}"),
+    }
+    assert_eq!(b.value_display.as_deref(), Some("On"));
+}
+
+#[test]
+fn document_default_property_is_marked_default() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        let normal_pp = ParaProps {
+            alignment: Some(ParagraphAlignment::Left),
+            ..Default::default()
+        };
+        insert(
+            &mut c,
+            para("Normal", None, normal_pp, CharProps::default()),
+        );
+        insert(
+            &mut c,
+            para("Loose", None, ParaProps::default(), CharProps::default()),
+        );
+        c.default_paragraph_style = Some(StyleId::new("Normal"));
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Loose"));
+    let a = row(&rows, StyleProperty::Alignment);
+    assert_eq!(a.provenance, RowProvenance::Default);
+    assert_eq!(a.value_display.as_deref(), Some("Left"));
+}
+
+#[test]
+fn formats_points_and_run_default_char_props() {
+    let cat = {
+        let mut c = StyleCatalog::new();
+        let pp = ParaProps {
+            indent_start: Some(Points::new(36.0)),
+            ..Default::default()
+        };
+        let cp = CharProps {
+            font_size: Some(Points::new(12.0)),
+            font_name: Some("Inter".to_string()),
+            ..Default::default()
+        };
+        insert(&mut c, para("Body", None, pp, cp));
+        c
+    };
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Body"));
+    assert_eq!(
+        row(&rows, StyleProperty::IndentStart)
+            .value_display
+            .as_deref(),
+        Some("36 pt")
+    );
+    assert_eq!(
+        row(&rows, StyleProperty::FontSize).value_display.as_deref(),
+        Some("12 pt")
+    );
+    assert_eq!(
+        row(&rows, StyleProperty::FontFamily)
+            .value_display
+            .as_deref(),
+        Some("Inter")
+    );
+}
+
+#[test]
+fn unknown_style_yields_no_rows() {
+    let cat = StyleCatalog::new();
+    assert!(paragraph_inspector_rows(&cat, &StyleId::new("Ghost")).is_empty());
+}
+
+#[test]
+fn clearing_a_local_override_falls_through_to_inherited() {
+    let mut cat = StyleCatalog::new();
+    let base_pp = ParaProps {
+        alignment: Some(ParagraphAlignment::Justify),
+        ..Default::default()
+    };
+    insert(&mut cat, para("Base", None, base_pp, CharProps::default()));
+    // Child locally overrides alignment to Center.
+    let child_pp = ParaProps {
+        alignment: Some(ParagraphAlignment::Center),
+        ..Default::default()
+    };
+    insert(
+        &mut cat,
+        para("Child", Some("Base"), child_pp, CharProps::default()),
+    );
+
+    // Before reset: the row is Local/Center.
+    let before = paragraph_inspector_rows(&cat, &StyleId::new("Child"));
+    assert!(row(&before, StyleProperty::Alignment).provenance.is_local());
+
+    // Reset the local override.
+    let child = cat
+        .paragraph_styles
+        .get_mut(&StyleId::new("Child"))
+        .unwrap();
+    clear_local_property(child, StyleProperty::Alignment);
+
+    // After reset: alignment now resolves as Inherited from Base (Justify).
+    let after = paragraph_inspector_rows(&cat, &StyleId::new("Child"));
+    let a = row(&after, StyleProperty::Alignment);
+    assert_eq!(
+        a.provenance,
+        RowProvenance::Inherited {
+            ancestor_id: StyleId::new("Base"),
+            ancestor_display: "Base".to_string(),
+        }
+    );
+    assert_eq!(a.value_display.as_deref(), Some("Justify"));
+}
+
+#[test]
+fn clearing_the_only_source_falls_through_to_format_default() {
+    let mut cat = StyleCatalog::new();
+    let pp = ParaProps {
+        indent_start: Some(loki_doc_model::loki_primitives::units::Points::new(24.0)),
+        ..Default::default()
+    };
+    insert(&mut cat, para("Solo", None, pp, CharProps::default()));
+
+    let solo = cat.paragraph_styles.get_mut(&StyleId::new("Solo")).unwrap();
+    clear_local_property(solo, StyleProperty::IndentStart);
+
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Solo"));
+    let r = row(&rows, StyleProperty::IndentStart);
+    assert_eq!(r.provenance, RowProvenance::FormatDefault);
+    assert_eq!(r.value_display, None);
+}
+
+#[test]
+fn clearing_char_props_resets_run_defaults() {
+    let mut cat = StyleCatalog::new();
+    let cp = CharProps {
+        bold: Some(true),
+        font_name: Some("Inter".to_string()),
+        ..Default::default()
+    };
+    insert(&mut cat, para("Body", None, ParaProps::default(), cp));
+
+    let body = cat.paragraph_styles.get_mut(&StyleId::new("Body")).unwrap();
+    clear_local_property(body, StyleProperty::Bold);
+    clear_local_property(body, StyleProperty::FontFamily);
+
+    let rows = paragraph_inspector_rows(&cat, &StyleId::new("Body"));
+    assert_eq!(
+        row(&rows, StyleProperty::Bold).provenance,
+        RowProvenance::FormatDefault
+    );
+    assert_eq!(
+        row(&rows, StyleProperty::FontFamily).provenance,
+        RowProvenance::FormatDefault
+    );
+}
diff --git a/loki-text/src/routes/editor/style_list_inspector.rs b/loki-text/src/routes/editor/style_list_inspector.rs
new file mode 100644
index 00000000..7e12abc6
--- /dev/null
+++ b/loki-text/src/routes/editor/style_list_inspector.rs
@@ -0,0 +1,105 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! The read-only inspector model for **list styles** (Spec 05 M6 — the list
+//! family).
+//!
+//! Unlike the paragraph and character families, list styles do **not** inherit:
+//! a [`ListStyle`](loki_doc_model::style::ListStyle) is a flat vector of
+//! per-level definitions (ADR-0004; ODF `text:list-style` / OOXML
+//! `w:abstractNum`), so there is no provenance chain to resolve — each level's
+//! label kind and geometry are read directly. This module flattens a list style
+//! into one display row per indent level for the family panel, mirroring the
+//! `paragraph_inspector_rows` / `character_inspector_rows` role for its family.
+//!
+//! Pure + i18n-free (like the sibling inspector models): value-like text such as
+//! `"Bullet"`, `"Decimal"`, or `"18 pt"` is baked here the same way the character
+//! inspector bakes `"On"` / `"12 pt"`; the family panel localises the surrounding
+//! field labels.
+
+use loki_doc_model::loki_primitives::units::Points;
+use loki_doc_model::style::{
+    BulletChar, LabelAlignment, ListId, ListLevel, ListLevelKind, NumberingScheme, StyleCatalog,
+};
+
+/// One display row per list-style indent level (Spec 05 §9 list family).
+///
+/// A list style is non-inheriting, so every field is the level's own value —
+/// there is no provenance to attach.
+pub struct ListLevelRow {
+    /// The zero-indexed indent level (0 = outermost).
+    pub level: u8,
+    /// The label kind — a bullet char, a numbered scheme, or "None".
+    pub label: String,
+    /// The start indent, formatted in points.
+    pub indent: String,
+    /// The hanging indent, formatted in points.
+    pub hanging: String,
+    /// The label alignment (Left / Right / Center).
+    pub alignment: String,
+}
+
+/// Builds one [`ListLevelRow`] per indent level of the list style `id`, in level
+/// order. Returns an empty vector when `id` is not a list style in the catalog.
+#[must_use]
+pub fn list_inspector_rows(catalog: &StyleCatalog, id: &ListId) -> Vec<ListLevelRow> {
+    let Some(style) = catalog.list_styles.get(id) else {
+        return Vec::new();
+    };
+    style.levels.iter().map(build_row).collect()
+}
+
+fn build_row(level: &ListLevel) -> ListLevelRow {
+    ListLevelRow {
+        level: level.level,
+        label: label_display(&level.kind),
+        indent: fmt_points(level.indent_start),
+        hanging: fmt_points(level.hanging_indent),
+        alignment: alignment_display(level.label_alignment),
+    }
+}
+
+/// A short human-readable summary of a level's label.
+fn label_display(kind: &ListLevelKind) -> String {
+    match kind {
+        ListLevelKind::Bullet { char, .. } => match char {
+            BulletChar::Char(c) => format!("Bullet {c}"),
+            BulletChar::Image => "Image bullet".to_string(),
+            _ => "Bullet".to_string(),
+        },
+        ListLevelKind::Numbered { scheme, .. } => format!("Numbered · {}", scheme_name(*scheme)),
+        ListLevelKind::None => "None".to_string(),
+        _ => "—".to_string(),
+    }
+}
+
+/// A short example/name for a numbering scheme.
+fn scheme_name(scheme: NumberingScheme) -> &'static str {
+    match scheme {
+        NumberingScheme::Decimal => "Decimal",
+        NumberingScheme::LowerAlpha => "a, b, c",
+        NumberingScheme::UpperAlpha => "A, B, C",
+        NumberingScheme::LowerRoman => "i, ii, iii",
+        NumberingScheme::UpperRoman => "I, II, III",
+        NumberingScheme::Ordinal => "Ordinal",
+        NumberingScheme::None => "None",
+        _ => "—",
+    }
+}
+
+fn alignment_display(alignment: LabelAlignment) -> String {
+    match alignment {
+        LabelAlignment::Left => "Left",
+        LabelAlignment::Right => "Right",
+        LabelAlignment::Center => "Center",
+        _ => "—",
+    }
+    .to_string()
+}
+
+fn fmt_points(p: Points) -> String {
+    format!("{:.0} pt", p.value())
+}
+
+#[cfg(test)]
+#[path = "style_list_inspector_tests.rs"]
+mod tests;
diff --git a/loki-text/src/routes/editor/style_list_inspector_tests.rs b/loki-text/src/routes/editor/style_list_inspector_tests.rs
new file mode 100644
index 00000000..82e5390a
--- /dev/null
+++ b/loki-text/src/routes/editor/style_list_inspector_tests.rs
@@ -0,0 +1,116 @@
+// SPDX-License-Identifier: Apache-2.0
+
+//! List-style inspector rows (Spec 05 M6 list family): one flattened row per
+//! indent level, non-inheriting.
+
+use super::*;
+use loki_doc_model::style::props::char_props::CharProps;
+use loki_doc_model::style::{ListStyle, StyleCatalog};
+
+fn level(n: u8, kind: ListLevelKind, indent: f64, hanging: f64) -> ListLevel {
+    ListLevel {
+        level: n,
+        kind,
+        indent_start: Points::new(indent),
+        hanging_indent: Points::new(hanging),
+        label_alignment: LabelAlignment::Left,
+        tab_stop_after_label: None,
+        char_props: CharProps::default(),
+    }
+}
+
+fn insert(cat: &mut StyleCatalog, id: &str, levels: Vec<ListLevel>) {
+    cat.list_styles.insert(
+        ListId::new(id),
+        ListStyle {
+            id: ListId::new(id),
+            display_name: None,
+            levels,
+            extensions: Default::default(),
+        },
+    );
+}
+
+#[test]
+fn one_row_per_level_in_order() {
+    let mut cat = StyleCatalog::new();
+    insert(
+        &mut cat,
+        "L",
+        vec![
+            level(
+                0,
+                ListLevelKind::Bullet {
+                    char: BulletChar::Char('•'),
+                    font: None,
+                },
+                18.0,
+                18.0,
+            ),
+            level(
+                1,
+                ListLevelKind::Bullet {
+                    char: BulletChar::Char('◦'),
+                    font: None,
+                },
+                36.0,
+                18.0,
+            ),
+        ],
+    );
+    let rows = list_inspector_rows(&cat, &ListId::new("L"));
+    assert_eq!(rows.len(), 2);
+    assert_eq!(rows[0].level, 0);
+    assert_eq!(rows[1].level, 1);
+}
+
+#[test]
+fn bullet_level_shows_its_char_and_geometry() {
+    let mut cat = StyleCatalog::new();
+    insert(
+        &mut cat,
+        "L",
+        vec![level(
+            0,
+            ListLevelKind::Bullet {
+                char: BulletChar::Char('•'),
+                font: None,
+            },
+            18.0,
+            9.0,
+        )],
+    );
+    let rows = list_inspector_rows(&cat, &ListId::new("L"));
+    assert_eq!(rows[0].label, "Bullet •");
+    assert_eq!(rows[0].indent, "18 pt");
+    assert_eq!(rows[0].hanging, "9 pt");
+    assert_eq!(rows[0].alignment, "Left");
+}
+
+#[test]
+fn numbered_level_names_its_scheme() {
+    let mut cat = StyleCatalog::new();
+    insert(
+        &mut cat,
+        "L",
+        vec![level(
+            0,
+            ListLevelKind::Numbered {
+                scheme: NumberingScheme::Decimal,
+                start_value: 1,
+                format: "%1.".to_string(),
+                display_levels: 1,
+            },
+            18.0,
+            18.0,
+        )],
+    );
+    let rows = list_inspector_rows(&cat, &ListId::new("L"));
+    assert_eq!(rows[0].label, "Numbered · Decimal");
+}
+
+#[test]
+fn unknown_list_style_yields_no_rows() {
+    let cat = StyleCatalog::new();
+    assert!(list_inspector_rows(&cat, &ListId::new("Ghost")).is_empty());
+}
diff --git a/output.png b/output.png
deleted file mode 100644
index e16c7d2b..00000000
Binary files a/output.png and /dev/null differ
diff --git a/scratch.rs b/scratch.rs
deleted file mode 100644
index 2dd3b143..00000000
--- a/scratch.rs
+++ /dev/null
@@ -1,10 +0,0 @@
-use dioxus::prelude::*;
-fn app() -> Element {
-    rsx! {
-        div {
-            onscroll: |evt| {
-                let _ = evt.get_scroll_offset(); // Check if this exists
-            }
-        }
-    }
-}
diff --git a/scripts/check-dependency-direction.py b/scripts/check-dependency-direction.py
new file mode 100755
index 00000000..256383ae
--- /dev/null
+++ b/scripts/check-dependency-direction.py
@@ -0,0 +1,141 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""Dependency-direction gate (Spec 01 audit A-13; ADR-0009 invariant I1).
+
+Every internal (workspace-member) **normal** dependency must point *downhill or
+sideways* in the layer model from `docs/adr/0009-target-architecture.md`:
+`layer(crate) >= layer(dep)`. An uphill edge — e.g. render → ui, or model →
+layout — fails the build, which is what keeps the architecture from eroding
+after Spec 01 lands.
+
+A crate that is neither in `LAYERS` nor `EXEMPT` fails, forcing an explicit
+layer assignment when a crate is added (ADR-0009: "the gate fails on any
+unmapped crate"). `dev`/`build` dependency edges are ignored (only the shipped
+dependency graph defines the architecture).
+
+Usage:
+    scripts/check-dependency-direction.py
+    scripts/check-dependency-direction.py --graph   # print the internal edges
+"""
+
+from __future__ import annotations
+
+import json
+import subprocess
+import sys
+
+# Layer numbers — see ADR-0009 §"layer assignment table". Lower = more
+# foundational. `loki-pdf` is the L3b "exporter-above-layout" tier (3.5).
+LAYERS: dict[str, float] = {
+    # L0 foundation
+    "loki-primitives": 0, "loki-fonts": 0, "loki-i18n": 0, "loki-spell": 0,
+    "loki-graphics": 0,
+    # L1 model
+    "loki-doc-model": 1, "loki-sheet-model": 1, "loki-presentation-model": 1,
+    # L2 io/serde + content
+    "loki-opc": 2, "loki-odf": 2, "loki-ooxml": 2, "loki-epub": 2,
+    "loki-templates": 2,
+    # L3 layout
+    "loki-layout": 3,
+    # L3b exporter-above-layout
+    "loki-pdf": 3.5,
+    # L4 render
+    "loki-render-cache": 4, "appthere-canvas": 4, "loki-vello": 4,
+    "loki-renderer": 4,
+    # L5 ui / app-shell
+    "appthere-ui": 5, "loki-app-shell": 5,
+    # L6 app binaries
+    "loki-text": 6, "loki-spreadsheet": 6, "loki-presentation": 6,
+    # ── Server subsystem (backend; web-server spec ADRs C012–C028) ──────────
+    # A separate top-level stack: it consumes the document/format libraries
+    # (loki-convert reaches down to loki-pdf at L3.5) but is never consumed by
+    # the client app binaries, so it sits above L6. Layers order the server
+    # crates by their own dependency graph (all edges verified downhill).
+    # L7 server foundation
+    "loki-model": 7, "loki-crypto": 7, "loki-server-audit": 7, "loki-print": 7,
+    # L8 server services + document conversion
+    "loki-server-store": 8, "loki-server-auth": 8, "loki-convert": 8,
+    # L9 collaboration relay
+    "loki-server-collab": 9,
+    # L10 server API surface
+    "loki-server-api": 10,
+    # L11 server + headless binaries
+    "loki-server": 11, "loki-headless": 11,
+}
+
+# Dev/test members outside the layering (ADR-0009): conformance/test/benchmark
+# harnesses depend across every layer by design. Their outgoing edges are not
+# checked.
+EXEMPT: set[str] = {"loki-acid", "appthere-conformance", "loki-bench"}
+
+
+def metadata() -> dict:
+    out = subprocess.check_output(
+        ["cargo", "metadata", "--no-deps", "--format-version", "1"],
+        text=True,
+    )
+    return json.loads(out)
+
+
+def main() -> int:
+    meta = metadata()
+    internal = {p["name"] for p in meta["packages"]}
+    edges: list[tuple[str, str]] = []
+    failures: list[str] = []
+    unmapped: set[str] = set()
+
+    for pkg in meta["packages"]:
+        name = pkg["name"]
+        if name not in LAYERS and name not in EXEMPT:
+            unmapped.add(name)
+        if name in EXEMPT:
+            continue
+        for dep in pkg["dependencies"]:
+            dname = dep["name"]
+            if dname not in internal or dname == name:
+                continue
+            if (dep.get("kind") or "normal") != "normal":
+                continue  # dev/build deps don't define the architecture
+            edges.append((name, dname))
+            if dname in EXEMPT:
+                failures.append(
+                    f"{name} -> {dname}: depends on a test-only crate"
+                )
+                continue
+            if name in LAYERS and dname in LAYERS and LAYERS[name] < LAYERS[dname]:
+                failures.append(
+                    f"{name} (L{LAYERS[name]:g}) -> {dname} (L{LAYERS[dname]:g}): "
+                    f"UPHILL edge — a lower layer must not import a higher one"
+                )
+            if dname not in LAYERS:
+                unmapped.add(dname)
+
+    if "--graph" in sys.argv:
+        for a, b in sorted(edges):
+            la = f"L{LAYERS.get(a, '?'):g}" if a in LAYERS else "?"
+            lb = f"L{LAYERS.get(b, '?'):g}" if b in LAYERS else "?"
+            print(f"{a} ({la}) -> {b} ({lb})")
+        return 0
+
+    for u in sorted(unmapped):
+        failures.append(
+            f"{u}: not assigned a layer — add it to LAYERS in this script and "
+            f"to ADR-0009's table (or to EXEMPT if it is test-only)"
+        )
+
+    if failures:
+        print(f"Dependency-direction gate: {len(failures)} violation(s):\n")
+        for v in sorted(set(failures)):
+            print(f"  ✗ {v}")
+        print("\nDependencies must flow downhill per docs/adr/"
+              "0009-target-architecture.md (audit A-13 / invariant I1).")
+        return 1
+
+    print(f"Dependency-direction gate: OK — {len(edges)} internal edges, "
+          f"all downhill/sideways across {len(LAYERS)} mapped crates.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-file-ceiling.py b/scripts/check-file-ceiling.py
new file mode 100755
index 00000000..1fa30b91
--- /dev/null
+++ b/scripts/check-file-ceiling.py
@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""File-ceiling gate (Spec 01 audit A-2 / CLAUDE.md 300-line ceiling).
+
+No first-party production `.rs` file may exceed 300 lines. Pre-existing
+violations are frozen in `scripts/file-ceiling-baseline.txt` as a **ratchet**:
+
+  * a file NOT in the baseline must be <= 300 lines;
+  * a baselined file may exceed 300 but must NOT grow beyond its recorded count
+    (debt can only shrink);
+  * when a baselined file drops to <= 300 it must be removed from the baseline
+    (no stale grants);
+  * a baseline entry for a missing/renamed file fails (keeps the list honest).
+
+So new files can't be born over-ceiling, the known over-ceiling files can't
+grow, and the backlog monotonically shrinks toward empty.
+
+Scope: first-party production `.rs`. Excluded (CLAUDE.md exempts test files):
+`tests/`, `*_tests.rs`, `*/tests.rs`, `benches/`, `examples/`, and `patches/*`.
+
+Usage:
+    scripts/check-file-ceiling.py            # enforce
+    scripts/check-file-ceiling.py --update   # rewrite the baseline from current
+                                             # counts (review the diff!)
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+BASELINE_FILE = REPO / "scripts" / "file-ceiling-baseline.txt"
+CEILING = 300
+
+
+def is_test(rel: str) -> bool:
+    return (
+        "/tests/" in rel
+        or rel.endswith("_tests.rs")
+        or rel.endswith("/tests.rs")
+        or "/benches/" in rel
+        or "/examples/" in rel
+        or rel.startswith("patches/")
+    )
+
+
+def production_files() -> dict[str, int]:
+    out = subprocess.check_output(["git", "ls-files", "*.rs"], cwd=REPO, text=True)
+    counts: dict[str, int] = {}
+    for rel in out.splitlines():
+        if not rel or is_test(rel):
+            continue
+        text = (REPO / rel).read_text(encoding="utf-8", errors="replace")
+        # Number of lines, matching `wc -l` (trailing newline not double-counted).
+        counts[rel] = text.count("\n") + (0 if text.endswith("\n") or not text else 1)
+    return counts
+
+
+def load_baseline() -> dict[str, int]:
+    base: dict[str, int] = {}
+    if not BASELINE_FILE.exists():
+        return base
+    for line in BASELINE_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if not line:
+            continue
+        count, path = line.split(None, 1)
+        base[path.strip()] = int(count)
+    return base
+
+
+def write_baseline(counts: dict[str, int]) -> None:
+    over = sorted(
+        ((n, p) for p, n in counts.items() if n > CEILING), reverse=True
+    )
+    lines = [
+        "# File-ceiling baseline — pre-existing >300-line production files (A-2).",
+        "# Format: `<linecount> <path>`. Ratcheted by scripts/check-file-ceiling.py:",
+        "# these may not GROW, and must be removed once split to <= 300 lines.",
+        "# Regenerate with: scripts/check-file-ceiling.py --update",
+        "",
+    ]
+    lines += [f"{n} {p}" for n, p in over]
+    BASELINE_FILE.write_text("\n".join(lines) + "\n", encoding="utf-8")
+    print(f"Wrote {len(over)} entries to {BASELINE_FILE.relative_to(REPO)}")
+
+
+def main() -> int:
+    counts = production_files()
+    if "--update" in sys.argv:
+        write_baseline(counts)
+        return 0
+
+    baseline = load_baseline()
+    failures: list[str] = []
+
+    for rel, n in sorted(counts.items()):
+        if rel in baseline:
+            if n <= CEILING:
+                failures.append(
+                    f"{rel}: now {n} lines (<= {CEILING}) — remove it from "
+                    f"the baseline (debt resolved 🎉)"
+                )
+            elif n > baseline[rel]:
+                failures.append(
+                    f"{rel}: grew to {n} lines (baseline {baseline[rel]}) — "
+                    f"split it; do not grow over-ceiling files"
+                )
+        elif n > CEILING:
+            failures.append(
+                f"{rel}: {n} lines > {CEILING} ceiling — split it (or, for "
+                f"genuine pre-existing debt, run --update to baseline it)"
+            )
+
+    for rel in sorted(baseline):
+        if rel not in counts:
+            failures.append(
+                f"{rel}: in the baseline but no longer a tracked production file "
+                f"— remove the stale entry"
+            )
+
+    if failures:
+        print(f"File-ceiling gate: {len(failures)} violation(s):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        return 1
+
+    over = sum(1 for p, n in counts.items() if n > CEILING)
+    print(f"File-ceiling gate: OK — {len(counts)} production files, "
+          f"{over} baselined over-ceiling (ratcheted), none grew, no new ones.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-license-headers.py b/scripts/check-license-headers.py
new file mode 100755
index 00000000..80626138
--- /dev/null
+++ b/scripts/check-license-headers.py
@@ -0,0 +1,132 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""License-header gate (Spec 01 §6.2 `spdx_header_line_one`, license-aware).
+
+Every tracked `.rs` file in a first-party workspace crate must begin, on
+**line 1**, with the SPDX identifier matching that crate's declared
+`license` in its `Cargo.toml`. This enforces two things at once:
+
+  * the SPDX-on-line-1 convention (CLAUDE.md), and
+  * the per-crate license distinction — notably `loki-opc`, which is
+    **MIT** (it will be released standalone) while the rest of the suite is
+    **Apache-2.0**. See `docs/adr/0010-per-crate-licensing.md`.
+
+Scope: first-party workspace members only. The vendored `patches/*` tree is
+excluded (upstream code keeps its own `MIT OR Apache-2.0` headers). Files
+listed in `scripts/license-header-exceptions.txt` (one repo-relative path per
+line, `#` comments allowed) are skipped with a reason.
+
+Usage:
+    scripts/check-license-headers.py            # fail on any violation
+    scripts/check-license-headers.py --list     # print the resolved crate→license map
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+EXCEPTIONS_FILE = REPO / "scripts" / "license-header-exceptions.txt"
+LICENSE_RE = re.compile(r'^license\s*=\s*"([^"]*)"', re.MULTILINE)
+PACKAGE_RE = re.compile(r'^\[package\]', re.MULTILINE)
+
+
+def tracked_rs_files() -> list[Path]:
+    out = subprocess.check_output(
+        ["git", "ls-files", "*.rs"], cwd=REPO, text=True
+    )
+    return [REPO / line for line in out.splitlines() if line]
+
+
+def crate_license_map() -> dict[Path, str]:
+    """Map each first-party crate directory to its declared license."""
+    out = subprocess.check_output(
+        ["git", "ls-files", "*/Cargo.toml", "Cargo.toml"], cwd=REPO, text=True
+    )
+    crates: dict[Path, str] = {}
+    for rel in out.splitlines():
+        if not rel or rel.startswith("patches/"):
+            continue
+        manifest = REPO / rel
+        text = manifest.read_text(encoding="utf-8", errors="replace")
+        if not PACKAGE_RE.search(text):
+            continue  # virtual/workspace-only manifest (e.g. root)
+        m = LICENSE_RE.search(text)
+        if m:
+            crates[manifest.parent] = m.group(1)
+    return crates
+
+
+def owning_license(path: Path, crates: dict[Path, str]) -> tuple[Path, str] | None:
+    """Nearest ancestor crate dir + its license, or None if not first-party."""
+    best: tuple[Path, str] | None = None
+    for crate_dir, lic in crates.items():
+        if path.is_relative_to(crate_dir):
+            if best is None or len(crate_dir.parts) > len(best[0].parts):
+                best = (crate_dir, lic)
+    return best
+
+
+def load_exceptions() -> set[str]:
+    if not EXCEPTIONS_FILE.exists():
+        return set()
+    out = set()
+    for line in EXCEPTIONS_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            out.add(line)
+    return out
+
+
+def main() -> int:
+    crates = crate_license_map()
+    if "--list" in sys.argv:
+        for d in sorted(crates):
+            print(f"{d.relative_to(REPO)} -> {crates[d]}")
+        return 0
+
+    exceptions = load_exceptions()
+    failures: list[str] = []
+    checked = 0
+
+    for f in tracked_rs_files():
+        rel = str(f.relative_to(REPO))
+        if rel in exceptions:
+            continue
+        owner = owning_license(f, crates)
+        if owner is None:
+            continue  # not part of a first-party crate (e.g. stray root file)
+        _, lic = owner
+        expected = f"// SPDX-License-Identifier: {lic}"
+        try:
+            first = f.read_text(encoding="utf-8", errors="replace").splitlines()[:1]
+        except OSError as exc:
+            failures.append(f"{rel}: cannot read ({exc})")
+            continue
+        checked += 1
+        line1 = first[0] if first else ""
+        if line1 != expected:
+            failures.append(f"{rel}: line 1 is {line1!r}, expected {expected!r}")
+
+    if failures:
+        print(f"License-header gate: {len(failures)} violation(s) "
+              f"({checked} files checked):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        print("\nFix: ensure line 1 is the SPDX id matching the crate's "
+              "Cargo.toml `license`.\n"
+              "loki-opc is MIT; the rest of the suite is Apache-2.0 "
+              "(docs/adr/0010-per-crate-licensing.md).")
+        return 1
+
+    print(f"License-header gate: OK — {checked} files, all line-1 SPDX ids "
+          f"match their crate license.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-no-hardcoded-viewport-dims.py b/scripts/check-no-hardcoded-viewport-dims.py
new file mode 100755
index 00000000..753b0456
--- /dev/null
+++ b/scripts/check-no-hardcoded-viewport-dims.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""Hardcoded-viewport-dimension guard (Spec 01 audit A-1 / §6.2).
+
+Forbids bare **screen-resolution-class** numeric literals (1280, 1920, 1024, …)
+in the editor's input / hit-test / viewport code paths. These paths must take
+their width/height from the measured `Viewport` / `scroll_metrics`, never from
+an assumed window size — that assumption was the 1280px bug (A-1). This makes
+that bug class un-reintroducible in the files where it lived.
+
+This is the pragmatic, stable-toolchain stand-in for the `no_hardcoded_layout_dims`
+**dylint** the spec envisions (§6.2). A true dylint does AST-level analysis on a
+pinned nightly via the dylint driver — infrastructure not present in this CI — so
+it remains a deferred specialist task; this gate covers the specific, high-value
+class over the scoped hot-paths in the meantime.
+
+A named `const`/`static` is the sanctioned alternative (e.g.
+`DEFAULT_VIEWPORT_HEIGHT_PX`); literals on a `const`/`static` definition line,
+in comments, or in test files are ignored. Genuine exceptions go in
+`scripts/viewport-dims-allowlist.txt` (path:line, with a justification comment).
+
+Usage:
+    scripts/check-no-hardcoded-viewport-dims.py
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+ALLOWLIST_FILE = REPO / "scripts" / "viewport-dims-allowlist.txt"
+
+# Scoped to the editor input / hit-test / viewport paths where the 1280 bug
+# lived and where dimensions must come from the measured Viewport.
+SCOPED_DIRS = (
+    "loki-text/src/routes/editor/",
+    "loki-text/src/editing/",
+)
+
+# Common display-resolution widths/heights. A bare literal from this set in a
+# layout path is almost always an assumed window size, not an intrinsic value.
+DIMS = [
+    640, 720, 768, 800, 960, 1024, 1080, 1136, 1280, 1366, 1440, 1536, 1600,
+    1680, 1920, 2048, 2560, 3440, 3840, 4096,
+]
+LITERAL = re.compile(
+    r"(?<![\w.])(?:" + "|".join(str(d) for d in DIMS) + r")(?:\.0+)?(?:_?f(?:32|64))?(?![\w.])"
+)
+CONST_DEF = re.compile(r"^\s*(pub(?:\([^)]*\))?\s+)?(const|static)\s")
+
+
+def is_test(rel: str) -> bool:
+    return rel.endswith("_tests.rs") or rel.endswith("/tests.rs") or "/tests/" in rel
+
+
+def load_allowlist() -> set[str]:
+    if not ALLOWLIST_FILE.exists():
+        return set()
+    out = set()
+    for line in ALLOWLIST_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            out.add(line)
+    return out
+
+
+def main() -> int:
+    allow = load_allowlist()
+    out = subprocess.check_output(["git", "ls-files", "*.rs"], cwd=REPO, text=True)
+    failures: list[str] = []
+    scanned = 0
+    for rel in out.splitlines():
+        if not rel or is_test(rel) or not rel.startswith(SCOPED_DIRS):
+            continue
+        scanned += 1
+        for i, line in enumerate(
+            (REPO / rel).read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            code = line.split("//", 1)[0]
+            if not LITERAL.search(code):
+                continue
+            if CONST_DEF.match(line):  # a named constant definition is allowed
+                continue
+            if f"{rel}:{i}" in allow:
+                continue
+            failures.append(f"{rel}:{i}: {line.strip()[:90]}")
+
+    if failures:
+        print(f"Viewport-dimension guard: {len(failures)} violation(s) "
+              f"({scanned} scoped files):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        print("\nDimensions in the editor input/viewport paths must come from the "
+              "measured `Viewport` / `scroll_metrics`, not an assumed screen size "
+              "(audit A-1). Name a `const` for an intrinsic default, or add a "
+              "justified entry to scripts/viewport-dims-allowlist.txt.")
+        return 1
+
+    print(f"Viewport-dimension guard: OK — {scanned} scoped files, "
+          f"no bare screen-dimension literals.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-no-panics.py b/scripts/check-no-panics.py
new file mode 100755
index 00000000..39f4b2e5
--- /dev/null
+++ b/scripts/check-no-panics.py
@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""Panic-guard gate (Spec 01 §6.1 / A-6).
+
+Fails if a first-party library source file (`<crate>/src/**.rs`) contains a
+forbidden panicking macro outside of test code:
+
+    panic!   todo!   unimplemented!
+
+These either abort the process on an unexpected path (`panic!`) or mark
+unfinished work that must not ship (`todo!` / `unimplemented!`). Library code
+must surface failures through its typed `thiserror` error enums instead.
+
+**`unreachable!` is intentionally permitted.** It asserts an invariant the type
+system can't express (e.g. "Reflow mode always returns Canvas") and each use in
+the tree carries a justifying message — this is documentation, not an ad-hoc
+abort. If you reach for `unreachable!`, give it a message.
+
+Scope: first-party `<crate>/src/` only. Excluded: `#[cfg(test)]` modules,
+`tests/`, `benches/`, `examples/`, the vendored `patches/*` tree, and any path
+in `scripts/no-panics-exceptions.txt` (each needing a justification comment).
+
+Usage:
+    scripts/check-no-panics.py
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+EXCEPTIONS_FILE = REPO / "scripts" / "no-panics-exceptions.txt"
+FORBIDDEN = re.compile(r"\b(panic!|todo!|unimplemented!)\s*[\(\[\{]")
+
+
+def lib_src_files() -> list[Path]:
+    out = subprocess.check_output(["git", "ls-files", "*.rs"], cwd=REPO, text=True)
+    files = []
+    for rel in out.splitlines():
+        if not rel or rel.startswith("patches/"):
+            continue
+        if "/src/" not in rel:
+            continue
+        if (
+            "/tests/" in rel
+            or "/benches/" in rel
+            or "/examples/" in rel
+            or rel.endswith("_tests.rs")
+            or rel.endswith("/tests.rs")
+        ):
+            continue
+        files.append(REPO / rel)
+    return files
+
+
+def strip_test_modules(src: str) -> list[tuple[int, str]]:
+    """Drop `#[cfg(test)]`-gated blocks via brace tracking."""
+    lines = src.split("\n")
+    out: list[tuple[int, str]] = []
+    k, n = 0, len(lines)
+    while k < n:
+        if re.search(r"#\[cfg\(test\)\]", lines[k]):
+            m, depth, started = k, 0, False
+            while m < n:
+                depth += lines[m].count("{") - lines[m].count("}")
+                if "{" in lines[m]:
+                    started = True
+                if started and depth <= 0:
+                    break
+                m += 1
+            k = m + 1
+            continue
+        out.append((k + 1, lines[k]))
+        k += 1
+    return out
+
+
+def load_exceptions() -> set[str]:
+    if not EXCEPTIONS_FILE.exists():
+        return set()
+    out = set()
+    for line in EXCEPTIONS_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            out.add(line)
+    return out
+
+
+def main() -> int:
+    exceptions = load_exceptions()
+    failures: list[str] = []
+    checked = 0
+    for f in lib_src_files():
+        rel = str(f.relative_to(REPO))
+        if rel in exceptions:
+            continue
+        checked += 1
+        for ln, line in strip_test_modules(
+            f.read_text(encoding="utf-8", errors="replace")
+        ):
+            if line.lstrip().startswith("//"):
+                continue  # comment / doc-comment
+            if FORBIDDEN.search(line):
+                failures.append(f"{rel}:{ln}: {line.strip()[:100]}")
+
+    if failures:
+        print(f"Panic-guard gate: {len(failures)} violation(s) "
+              f"({checked} lib files checked):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        print("\npanic!/todo!/unimplemented! are forbidden in library src. "
+              "Return a typed thiserror error instead; for an invariant the type "
+              "system can't express, use unreachable!(\"why\").")
+        return 1
+
+    print(f"Panic-guard gate: OK — {checked} lib files, no "
+          f"panic!/todo!/unimplemented!.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-todo-format.py b/scripts/check-todo-format.py
new file mode 100755
index 00000000..505eb889
--- /dev/null
+++ b/scripts/check-todo-format.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""TODO-format gate (Spec 01 audit A-11 / CLAUDE.md annotations).
+
+Every deferred-work marker in first-party production code must be a tagged
+`// TODO(<topic>):` so it stays greppable by topic (see the inventory in
+docs/adr/spec-01-todo-compat-inventory.md). This gate fails on:
+
+  * a bare `// TODO` / `// TODO:` with no `(topic)`;
+  * any `// FIXME` / `// HACK` / `// XXX` (CLAUDE.md uses `TODO(<topic>)` and
+    `COMPAT(<target>)`; these other markers are not part of the convention).
+
+Scope: first-party `<crate>/src/**.rs`. Excluded: `tests/`, `*_tests.rs`,
+`*/tests.rs`, `benches/`, `examples/`, `patches/*`. `COMPAT(<target>)` markers
+are a separate, sanctioned convention and are not checked here.
+
+Usage:
+    scripts/check-todo-format.py
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+
+# A bare TODO comment: `// TODO` not immediately followed by `(`.
+BARE_TODO = re.compile(r"//+\s*TODO(?!\s*\()")
+OTHER_MARKERS = re.compile(r"//+\s*(FIXME|HACK|XXX)\b")
+
+
+def is_excluded(rel: str) -> bool:
+    return (
+        "/src/" not in rel
+        or "/tests/" in rel
+        or rel.endswith("_tests.rs")
+        or rel.endswith("/tests.rs")
+        or "/benches/" in rel
+        or "/examples/" in rel
+        or rel.startswith("patches/")
+    )
+
+
+def main() -> int:
+    out = subprocess.check_output(["git", "ls-files", "*.rs"], cwd=REPO, text=True)
+    failures: list[str] = []
+    for rel in out.splitlines():
+        if not rel or is_excluded(rel):
+            continue
+        for i, line in enumerate(
+            (REPO / rel).read_text(encoding="utf-8", errors="replace").splitlines(), 1
+        ):
+            if BARE_TODO.search(line):
+                failures.append(f"{rel}:{i}: bare TODO — use `// TODO(<topic>): …`")
+            if OTHER_MARKERS.search(line):
+                m = OTHER_MARKERS.search(line).group(1)
+                failures.append(
+                    f"{rel}:{i}: `{m}` — convert to `// TODO(<topic>): …`"
+                )
+
+    if failures:
+        print(f"TODO-format gate: {len(failures)} violation(s):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        print("\nTag every deferred note as `// TODO(<topic>): …` so it stays "
+              "tracked (docs/adr/spec-01-todo-compat-inventory.md).")
+        return 1
+
+    print("TODO-format gate: OK — all TODOs are `TODO(<topic>)`-tagged; "
+          "no FIXME/HACK/XXX.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/check-unsafe-policy.py b/scripts/check-unsafe-policy.py
new file mode 100755
index 00000000..5356dbe8
--- /dev/null
+++ b/scripts/check-unsafe-policy.py
@@ -0,0 +1,137 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 AppThere Loki contributors
+"""Unsafe-policy gate (Spec 01 audit A-7).
+
+Every first-party crate root (`<crate>/src/lib.rs`, or `src/main.rs` for a
+bin-only crate) must carry one of:
+
+  * `#![forbid(unsafe_code)]` — the default; the crate has no `unsafe`; or
+  * `#![deny(unsafe_code)]`   — the crate needs `unsafe`, confined to a
+                                narrowly-scoped `#[allow(unsafe_code)]` item,
+                                AND the crate is on the reviewed allow-list
+                                (`scripts/unsafe-policy-allowlist.txt`).
+
+This makes the unsafe surface explicit and reviewed: a crate cannot silently
+introduce `unsafe` (it would need either `forbid` — which rejects it — or an
+allow-list entry). The allow-list and the set of `deny` crates must agree, so a
+crate that stops needing unsafe can't leave a stale grant behind.
+
+Scope: first-party workspace crates; the vendored `patches/*` tree is excluded.
+
+Usage:
+    scripts/check-unsafe-policy.py
+"""
+
+from __future__ import annotations
+
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+ALLOWLIST_FILE = REPO / "scripts" / "unsafe-policy-allowlist.txt"
+FORBID = re.compile(r"#!\[forbid\(unsafe_code\)\]")
+DENY = re.compile(r"#!\[deny\(unsafe_code\)\]")
+NAME = re.compile(r'^\s*name\s*=\s*"([^"]+)"', re.MULTILINE)
+PACKAGE = re.compile(r"^\[package\]", re.MULTILINE)
+
+
+def first_party_crates() -> dict[str, Path]:
+    """Map crate name -> crate dir for every first-party package."""
+    out = subprocess.check_output(
+        ["git", "ls-files", "*/Cargo.toml", "Cargo.toml"], cwd=REPO, text=True
+    )
+    crates: dict[str, Path] = {}
+    for rel in out.splitlines():
+        if not rel or rel.startswith("patches/"):
+            continue
+        manifest = REPO / rel
+        text = manifest.read_text(encoding="utf-8", errors="replace")
+        if not PACKAGE.search(text):
+            continue
+        m = NAME.search(text)
+        if m:
+            crates[m.group(1)] = manifest.parent
+    return crates
+
+
+def crate_root(crate_dir: Path) -> Path | None:
+    for cand in ("src/lib.rs", "src/main.rs"):
+        p = crate_dir / cand
+        if p.exists():
+            return p
+    return None
+
+
+def load_allowlist() -> set[str]:
+    if not ALLOWLIST_FILE.exists():
+        return set()
+    out = set()
+    for line in ALLOWLIST_FILE.read_text(encoding="utf-8").splitlines():
+        line = line.split("#", 1)[0].strip()
+        if line:
+            out.add(line)
+    return out
+
+
+def main() -> int:
+    crates = first_party_crates()
+    allow = load_allowlist()
+    failures: list[str] = []
+    deny_crates: set[str] = set()
+
+    for name, cdir in sorted(crates.items()):
+        root = crate_root(cdir)
+        if root is None:
+            failures.append(f"{name}: no src/lib.rs or src/main.rs found")
+            continue
+        head = root.read_text(encoding="utf-8", errors="replace")
+        has_forbid = bool(FORBID.search(head))
+        has_deny = bool(DENY.search(head))
+        rel = root.relative_to(REPO)
+        if has_forbid:
+            if name in allow:
+                failures.append(
+                    f"{name}: on the unsafe allow-list but root is "
+                    f"`forbid(unsafe_code)` — remove the stale allow-list entry "
+                    f"({rel})"
+                )
+            continue
+        if has_deny:
+            deny_crates.add(name)
+            if name not in allow:
+                failures.append(
+                    f"{name}: `deny(unsafe_code)` (needs unsafe) but NOT on the "
+                    f"allow-list — add it with justification or use `forbid` ({rel})"
+                )
+            continue
+        failures.append(
+            f"{name}: root has neither `#![forbid(unsafe_code)]` nor "
+            f"`#![deny(unsafe_code)]` ({rel})"
+        )
+
+    # Allow-list entries that aren't first-party crates at all. (Real crates that
+    # are listed-but-forbid are already reported as stale in the main loop.)
+    for stale in sorted(allow - set(crates)):
+        failures.append(f"allow-list: '{stale}' is not a first-party crate")
+
+    if failures:
+        print(f"Unsafe-policy gate: {len(failures)} violation(s) "
+              f"({len(crates)} crates):\n")
+        for v in failures:
+            print(f"  ✗ {v}")
+        print("\nEvery crate root must be `#![forbid(unsafe_code)]`, or "
+              "`#![deny(unsafe_code)]` with an entry in "
+              "scripts/unsafe-policy-allowlist.txt (Spec 01 audit A-7).")
+        return 1
+
+    print(f"Unsafe-policy gate: OK — {len(crates)} crates; "
+          f"{len(deny_crates)} allow-listed deny ({', '.join(sorted(deny_crates)) or 'none'}), "
+          f"rest forbid.")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/file-ceiling-baseline.txt b/scripts/file-ceiling-baseline.txt
new file mode 100644
index 00000000..2a7cc648
--- /dev/null
+++ b/scripts/file-ceiling-baseline.txt
@@ -0,0 +1,40 @@
+# File-ceiling baseline — pre-existing >300-line production files (A-2).
+# Format: `<linecount> <path>`. Ratcheted by scripts/check-file-ceiling.py:
+# these may not GROW, and must be removed once split to <= 300 lines.
+# Regenerate with: scripts/check-file-ceiling.py --update
+
+1979 loki-layout/src/para.rs
+1953 loki-layout/src/flow.rs
+1554 loki-odf/src/odt/reader/styles.rs
+1494 loki-odf/src/odt/reader/document.rs
+1244 loki-spreadsheet/src/routes/editor/editor_inner.rs
+1209 loki-ooxml/src/docx/reader/document.rs
+1073 loki-ooxml/src/docx/write/document.rs
+984 loki-layout/src/resolve.rs
+948 loki-vello/src/scene.rs
+878 loki-text/src/routes/editor/editor_inner.rs
+761 loki-layout/src/flow_para.rs
+730 loki-ooxml/src/docx/mapper/inline.rs
+651 loki-odf/src/package.rs
+611 loki-ooxml/src/docx/mapper/document.rs
+594 loki-text/src/editing/navigation.rs
+582 loki-ooxml/src/docx/mapper/props.rs
+575 loki-ooxml/src/xlsx/import.rs
+501 loki-text/src/routes/editor/editor_canvas.rs
+466 loki-ooxml/src/xlsx/export.rs
+465 loki-odf/src/ods/import.rs
+440 loki-doc-model/src/document.rs
+392 loki-renderer/src/document_view.rs
+388 loki-ooxml/src/docx/import.rs
+373 loki-layout/src/incremental.rs
+365 loki-odf/src/ods/export.rs
+364 loki-text/src/routes/home.rs
+333 loki-layout/src/lib.rs
+331 loki-text/src/editing/state.rs
+328 loki-ooxml/src/docx/model/paragraph.rs
+316 loki-text/src/routes/editor/editor_style.rs
+315 loki-text/src/routes/editor/editor_publish.rs
+315 loki-odf/src/odt/model/styles.rs
+314 loki-text/src/routes/editor/editor_ribbon.rs
+314 loki-renderer/src/page_paint_source.rs
+307 loki-ooxml/src/docx/mapper/table.rs
diff --git a/scripts/license-header-exceptions.txt b/scripts/license-header-exceptions.txt
new file mode 100644
index 00000000..bc4da67a
--- /dev/null
+++ b/scripts/license-header-exceptions.txt
@@ -0,0 +1,9 @@
+# Reviewed exceptions to the license-header gate (scripts/check-license-headers.py).
+#
+# One repo-relative path per line. `#` starts a comment. A path here is skipped
+# by the gate and MUST carry a justification comment above it.
+#
+# The vendored `patches/*` tree is excluded by the gate itself (upstream code
+# keeps its own "MIT OR Apache-2.0" headers), so it does not belong here.
+#
+# (no exceptions currently)
diff --git a/scripts/no-panics-exceptions.txt b/scripts/no-panics-exceptions.txt
new file mode 100644
index 00000000..1daee80e
--- /dev/null
+++ b/scripts/no-panics-exceptions.txt
@@ -0,0 +1,6 @@
+# Reviewed exceptions to the panic-guard gate (scripts/check-no-panics.py).
+#
+# One repo-relative path per line. `#` starts a comment. A path here is skipped
+# by the gate and MUST carry a justification comment above it.
+#
+# (no exceptions currently — library src is free of panic!/todo!/unimplemented!)
diff --git a/scripts/unsafe-policy-allowlist.txt b/scripts/unsafe-policy-allowlist.txt
new file mode 100644
index 00000000..44a3239b
--- /dev/null
+++ b/scripts/unsafe-policy-allowlist.txt
@@ -0,0 +1,16 @@
+# Crates permitted to use `#![deny(unsafe_code)]` + a scoped `#[allow(unsafe_code)]`
+# instead of `#![forbid(unsafe_code)]` (Spec 01 audit A-7).
+#
+# One crate name per line. `#` starts a comment. Every crate listed here MUST
+# confine its `unsafe` to a narrowly-scoped `#[allow(unsafe_code)]` item with a
+# SAFETY justification. A crate NOT listed here must carry `#![forbid(unsafe_code)]`
+# at its root — so a new crate cannot introduce unsafe without a reviewed entry.
+#
+# The three suite binaries need exactly one unsafe item: the Android
+# NativeActivity `android_main` FFI entry point, generated by
+# `loki_app_shell::android_main!` (which emits the scoped `#[allow(unsafe_code)]`).
+# The `#[unsafe(no_mangle)]` attribute alone (Rust 2024) makes `forbid` impossible
+# for these cdylibs.
+loki-text
+loki-presentation
+loki-spreadsheet
diff --git a/scripts/viewport-dims-allowlist.txt b/scripts/viewport-dims-allowlist.txt
new file mode 100644
index 00000000..84500a3e
--- /dev/null
+++ b/scripts/viewport-dims-allowlist.txt
@@ -0,0 +1,8 @@
+# Reviewed exceptions to the viewport-dimension guard
+# (scripts/check-no-hardcoded-viewport-dims.py).
+#
+# One `path:line` per line. `#` starts a comment. Each entry MUST carry a
+# justification. Prefer naming a `const` over an allow-list entry.
+#
+# (no exceptions currently — the one fallback default is the named
+#  DEFAULT_VIEWPORT_HEIGHT_PX constant in editor_canvas.rs)
diff --git a/test_log.txt b/test_log.txt
deleted file mode 100644
index 1735cacb..00000000
Binary files a/test_log.txt and /dev/null differ
diff --git a/test_log_utf8.txt b/test_log_utf8.txt
deleted file mode 100644
index 1a718108..00000000
--- a/test_log_utf8.txt
+++ /dev/null
@@ -1,85 +0,0 @@
-
-running 1 test
-=== Style Catalog Character Styles ===
-  char_style: Hyperlink
-  char_style: FootnoteReference
-  char_style: FootnoteTextChar
-  char_style: EndnoteReference
-  char_style: EndnoteTextChar
-=== Style Catalog Paragraph Styles ===
-  para_style: __DocDefault (parent: None)
-  para_style: Title (parent: Some(StyleId("Normal")))
-  para_style: Heading1 (parent: Some(StyleId("Normal")))
-  para_style: Heading2 (parent: Some(StyleId("Normal")))
-  para_style: Heading3 (parent: Some(StyleId("Normal")))
-  para_style: Heading4 (parent: Some(StyleId("Normal")))
-  para_style: Heading5 (parent: Some(StyleId("Normal")))
-  para_style: Heading6 (parent: Some(StyleId("Normal")))
-  para_style: Strong (parent: Some(StyleId("Normal")))
-  para_style: ListParagraph (parent: Some(StyleId("Normal")))
-  para_style: FootnoteText (parent: Some(StyleId("Normal")))
-  para_style: EndnoteText (parent: Some(StyleId("Normal")))
-  para_style: Normal (parent: Some(StyleId("__DocDefault")))
-=== Fontique Calibri Lookup ===
-Family name: Calibri
-Resolved font: face_idx=0, blob_len=1441448, blob_index=0, file_type=Single Font tables: ["GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(300.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=1, blob_len=1065868, blob_index=0, file_type=Single Font tables: ["GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(300.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=2, blob_len=1650632, blob_index=0, file_type=Single Font tables: ["EBDT", "EBLC", "GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(400.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=3, blob_len=1202512, blob_index=0, file_type=Single Font tables: ["EBDT", "EBLC", "GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(400.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=4, blob_len=1615616, blob_index=0, file_type=Single Font tables: ["EBDT", "EBLC", "GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(700.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=5, blob_len=1163904, blob_index=0, file_type=Single Font tables: ["EBDT", "EBLC", "GDEF", "GPOS", "GSUB", "OS/2", "cmap", "cvt ", "fpgm", "gasp", "glyf", "head", "hhea", "hmtx", "kern", "loca", "maxp", "meta", "name", "post", "prep"], weight=FontWeight(700.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-=== Content Blocks ===
-Block 0: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 120.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 1: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 8.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Cross-Platform Office Suite")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 2: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 16.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 16.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: Some(true), underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Architecture Design Document")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 3: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(200.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 200.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: None, direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), border_top: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_bottom: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_left: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_right: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), padding_top: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 4: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 5: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 4.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Version 1.0  ·  2025")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 6: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 4.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str(".NET · Avalonia UI · Skia · ODF · OOXML")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 7: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 8: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "TOC"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Table of Contents")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "TOC")])
-Block 9: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 10: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "exec_summary"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("1. Executive Summary")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "exec_summary")])
-Block 11: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki is a fully cross-platform, open-format office suite built on .NET and Avalonia UI. It targets Windows, macOS, Linux, Android, and iOS from a single codebase, delivering a desktop-class experience on tablets with keyboards while remaining fully usable on phones and in constrained tiling-window-manager tiles.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 12: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 13: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The suite provides four first-class document types: rich-text word processing, spreadsheets, vector drawings, and slide-deck presentations. All four share a common Skia rendering pipeline that is used identically for on-screen display, headless printing, and PDF/EPUB export.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 14: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 15: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(468.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 468.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Design Pillars")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("1) Modular, layered architecture with clean separation of concerns\n2) LibreOfficeKit-inspired interface layer (LokiKit) between engine and UI\n3) Tiled rendering for progressive, high-performance display and printing\n4) Responsive Design + Progressive Enhancement for every viewport\n5) Permissive OSS licensing (MIT/Apache-2.0) throughout")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.94509804, g: 0.9607843, b: 0.9764706 })), border_top: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_bottom: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_left: Some(Border { style: Solid, width: Length { value: 1.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_right: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), padding_top: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 16: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 17: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "goals"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2. Goals & Non-Goals")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "goals")])
-Block 18: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "goals_in"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2.1 Goals")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "goals_in")])
-Block 19: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Full read/write fidelity for ODF (ODT, ODS, ODP, ODG) and OOXML (DOCX, XLSX, PPTX, VSDX)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 20: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Export to PDF/A-2b and EPUB 3 from all document types")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 21: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Read/write support for Markdown (CommonMark + GFM), CSV, SVG, and Mermaid")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 22: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Single shared Skia renderer for UI display, headless CLI printing, and PDF generation")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 23: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Responsive, adaptive UI: phone, tablet, desktop, and tiling-WM tile modes")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 24: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Tablet + keyboard experience indistinguishable from desktop")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 25: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Headless printing API accessible without launching any UI")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 26: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Plugin/extension architecture for future community modules")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 27: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Full accessibility: WCAG 2.2 AA, platform accessibility trees via Avalonia")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 28: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Internationalisation and RTL text layout")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 29: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 30: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "non_goals"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2.2 Non-Goals (v1)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "non_goals")])
-Block 31: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Real-time collaborative editing (architecture is CRDT-ready but out of scope for v1)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 32: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Web browser / WASM target in v1")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 33: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Cloud storage integration in v1 (plugin seam is provided)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 34: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Macro scripting engine in v1")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 35: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 36: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "hla"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("3. High-Level Architecture")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "hla")])
-Block 37: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki follows a strict layered hourglass architecture. The narrow waist is LokiKit — a C#/.NET interface layer directly inspired by the LibreOfficeKit C headers — which completely decouples the presentation tier from the document-processing engine.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 38: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 39: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(468.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 468.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Layer Stack (top → bottom)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("[ Avalonia UI Shell / Platform Adapters ]\n           ↕  Avalonia ↕\n[ Responsive Layout Engine & Toolbar/Command System ]\n           ↕  LokiKit API ↕\n[ LokiKit — Document Interface & Tile Server ]\n           ↕  internal ↕\n[ Document Engine (per type) ]\n           ↕  internal ↕\n[ Format I/O Layer (ODF, OOXML, MD, CSV, SVG, Mermaid) ]\n           ↕  internal ↕\n[ Skia Render Pipeline  |  Export Pipeline (PDF/EPUB) ]\n           ↕  internal ↕\n[ Common Kernel: Fonts, Layout, Image, i18n, Storage ]")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.93333334, g: 0.9490196, b: 1.0 })), border_top: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_bottom: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_left: Some(Border { style: Solid, width: Length { value: 1.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_right: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), padding_top: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 40: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 41: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "lokikit"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("3.1 LokiKit — The Hourglass Waist")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "lokikit")])
-Block 42: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("LokiKit is a managed-.NET API surface mirroring the LibreOfficeKit C interface. The UI layer never touches the document model directly; all commands, queries, and rendered tiles flow through LokiKit. This means:")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 43: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The document engine can be used headlessly (CLI, server-side) with zero UI code")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 44: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The UI can be replaced or run in a unit-test harness without instantiating documents")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 45: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Tiled rendering is a first-class protocol: the UI requests tile bitmaps at a given zoom/offset, LokiKit rasterises them via Skia and returns them as SKBitmap or raw pixel spans")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 46: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Commands are dispatched as structured messages (discriminated unions in C#), not direct method calls, enabling undo/redo, macros, and future CRDT collaboration")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 47: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 48: Heading(3, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.050980393, g: 0.5803922, b: 0.53333336 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("LokiKit Core Interface")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })])
-Block 49: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Courier New"), font_name_complex: Some("Courier New"), font_name_east_asian: Some("Courier New"), font_size: Some(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("ILokiDocument")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-test diagnose_loki_architecture_import ... ok
-
-test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
-
diff --git a/test_output.png b/test_output.png
deleted file mode 100644
index cdf92ecb..00000000
Binary files a/test_output.png and /dev/null differ
diff --git a/test_output.txt b/test_output.txt
deleted file mode 100644
index d5f30d40..00000000
Binary files a/test_output.txt and /dev/null differ
diff --git a/test_output_utf8.txt b/test_output_utf8.txt
deleted file mode 100644
index 920ab7a1..00000000
--- a/test_output_utf8.txt
+++ /dev/null
@@ -1,85 +0,0 @@
-
-running 1 test
-=== Style Catalog Character Styles ===
-  char_style: Hyperlink
-  char_style: FootnoteReference
-  char_style: FootnoteTextChar
-  char_style: EndnoteReference
-  char_style: EndnoteTextChar
-=== Style Catalog Paragraph Styles ===
-  para_style: __DocDefault (parent: None)
-  para_style: Title (parent: Some(StyleId("Normal")))
-  para_style: Heading1 (parent: Some(StyleId("Normal")))
-  para_style: Heading2 (parent: Some(StyleId("Normal")))
-  para_style: Heading3 (parent: Some(StyleId("Normal")))
-  para_style: Heading4 (parent: Some(StyleId("Normal")))
-  para_style: Heading5 (parent: Some(StyleId("Normal")))
-  para_style: Heading6 (parent: Some(StyleId("Normal")))
-  para_style: Strong (parent: Some(StyleId("Normal")))
-  para_style: ListParagraph (parent: Some(StyleId("Normal")))
-  para_style: FootnoteText (parent: Some(StyleId("Normal")))
-  para_style: EndnoteText (parent: Some(StyleId("Normal")))
-  para_style: Normal (parent: Some(StyleId("__DocDefault")))
-=== Fontique Calibri Lookup ===
-Family name: Calibri
-Resolved font: face_idx=0, blob_len=1441448, blob_index=0, file_type=Single Font, weight=FontWeight(300.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=1, blob_len=1065868, blob_index=0, file_type=Single Font, weight=FontWeight(300.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=2, blob_len=1650632, blob_index=0, file_type=Single Font, weight=FontWeight(400.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=3, blob_len=1202512, blob_index=0, file_type=Single Font, weight=FontWeight(400.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=4, blob_len=1615616, blob_index=0, file_type=Single Font, weight=FontWeight(700.0), style=Normal, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-Resolved font: face_idx=5, blob_len=1163904, blob_index=0, file_type=Single Font, weight=FontWeight(700.0), style=Italic, mappings=[('A', Some(4)), ('p', Some(393)), ('T', Some(100)), ('h', Some(346)), ('e', Some(286)), ('r', Some(396)), (' ', Some(3)), ('L', Some(62)), ('o', Some(381)), ('k', Some(364)), ('i', Some(349)), ('C', Some(18)), ('s', Some(400)), ('-', Some(882)), ('P', Some(87)), ('l', Some(367)), ('a', Some(258)), ('t', Some(410)), ('f', Some(296)), ('m', Some(373)), ('O', Some(75)), ('c', Some(272)), ('S', Some(94)), ('u', Some(437))]
-=== Content Blocks ===
-Block 0: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 120.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 1: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 8.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Cross-Platform Office Suite")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 2: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 20.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 16.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 16.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: Some(true), underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Architecture Design Document")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 3: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(200.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 200.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: None, direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), border_top: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_bottom: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_left: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), border_right: Some(Border { style: None, width: Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: None, spacing: None }), padding_top: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 1.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 4: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 5: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 4.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Version 1.0  ·  2025")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 6: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: Some(Center), indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 4.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.5803922, g: 0.6392157, b: 0.72156864 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str(".NET · Avalonia UI · Skia · ODF · OOXML")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 7: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 8: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "TOC"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Table of Contents")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "TOC")])
-Block 9: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 10: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "exec_summary"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("1. Executive Summary")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "exec_summary")])
-Block 11: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki is a fully cross-platform, open-format office suite built on .NET and Avalonia UI. It targets Windows, macOS, Linux, Android, and iOS from a single codebase, delivering a desktop-class experience on tablets with keyboards while remaining fully usable on phones and in constrained tiling-window-manager tiles.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 12: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 13: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The suite provides four first-class document types: rich-text word processing, spreadsheets, vector drawings, and slide-deck presentations. All four share a common Skia rendering pipeline that is used identically for on-screen display, headless printing, and PDF/EPUB export.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 14: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 15: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(468.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 468.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Design Pillars")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("1) Modular, layered architecture with clean separation of concerns\n2) LibreOfficeKit-inspired interface layer (LokiKit) between engine and UI\n3) Tiled rendering for progressive, high-performance display and printing\n4) Responsive Design + Progressive Enhancement for every viewport\n5) Permissive OSS licensing (MIT/Apache-2.0) throughout")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.94509804, g: 0.9607843, b: 0.9764706 })), border_top: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_bottom: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_left: Some(Border { style: Solid, width: Length { value: 1.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), border_right: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), spacing: None }), padding_top: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 16: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 17: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "goals"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2. Goals & Non-Goals")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "goals")])
-Block 18: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "goals_in"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2.1 Goals")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "goals_in")])
-Block 19: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Full read/write fidelity for ODF (ODT, ODS, ODP, ODG) and OOXML (DOCX, XLSX, PPTX, VSDX)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 20: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Export to PDF/A-2b and EPUB 3 from all document types")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 21: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Read/write support for Markdown (CommonMark + GFM), CSV, SVG, and Mermaid")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 22: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Single shared Skia renderer for UI display, headless CLI printing, and PDF generation")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 23: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Responsive, adaptive UI: phone, tablet, desktop, and tiling-WM tile modes")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 24: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Tablet + keyboard experience indistinguishable from desktop")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 25: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Headless printing API accessible without launching any UI")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 26: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Plugin/extension architecture for future community modules")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 27: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Full accessibility: WCAG 2.2 AA, platform accessibility trees via Avalonia")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 28: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Internationalisation and RTL text layout")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 29: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 30: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "non_goals"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("2.2 Non-Goals (v1)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "non_goals")])
-Block 31: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Real-time collaborative editing (architecture is CRDT-ready but out of scope for v1)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 32: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Web browser / WASM target in v1")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 33: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Cloud storage integration in v1 (plugin seam is provided)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 34: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Macro scripting engine in v1")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 35: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: None, line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: Some(true), column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 36: Heading(1, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "hla"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 18.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.105882354, g: 0.16470589, b: 0.2901961 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("3. High-Level Architecture")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "hla")])
-Block 37: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("AppThere Loki follows a strict layered hourglass architecture. The narrow waist is LokiKit — a C#/.NET interface layer directly inspired by the LibreOfficeKit C headers — which completely decouples the presentation tier from the document-processing engine.")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 38: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 39: Table(Table { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, caption: TableCaption { short: None, full: [] }, width: Some(Fixed(468.0)), col_specs: [ColSpec { alignment: Default, width: Fixed(Length { value: 468.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }) }], head: TableHead { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] }, bodies: [TableBody { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, head_rows: [], body_rows: [Row { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, cells: [Cell { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, alignment: Default, row_span: 1, col_span: 1, blocks: [StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: None, space_after: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Layer Stack (top → bottom)")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("[ Avalonia UI Shell / Platform Adapters ]\n           ↕  Avalonia ↕\n[ Responsive Layout Engine & Toolbar/Command System ]\n           ↕  LokiKit API ↕\n[ LokiKit — Document Interface & Tile Server ]\n           ↕  internal ↕\n[ Document Engine (per type) ]\n           ↕  internal ↕\n[ Format I/O Layer (ODF, OOXML, MD, CSV, SVG, Mermaid) ]\n           ↕  internal ↕\n[ Skia Render Pipeline  |  Export Pipeline (PDF/EPUB) ]\n           ↕  internal ↕\n[ Common Kernel: Fonts, Layout, Image, i18n, Storage ]")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], props: CellProps { background_color: Some(Rgb(RgbColor { r: 0.93333334, g: 0.9490196, b: 1.0 })), border_top: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_bottom: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_left: Some(Border { style: Solid, width: Length { value: 1.5, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), border_right: Some(Border { style: Solid, width: Length { value: 0.125, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), spacing: None }), padding_top: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_bottom: Some(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_left: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), padding_right: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), vertical_align: None, text_direction: None } }] }] }], foot: TableFoot { attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, rows: [] } })
-Block 40: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 41: Heading(2, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [Bookmark(Start, "lokikit"), StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 14.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.14509805, g: 0.3882353, b: 0.92156863 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("3.1 LokiKit — The Hourglass Waist")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } }), Bookmark(End, "lokikit")])
-Block 42: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 3.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 5.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("LokiKit is a managed-.NET API surface mirroring the LibreOfficeKit C interface. The UI layer never touches the document model directly; all commands, queries, and rendered tiles flow through LokiKit. This means:")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 43: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The document engine can be used headlessly (CLI, server-side) with zero UI code")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 44: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("The UI can be replaced or run in a unit-test harness without instantiating documents")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 45: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Tiled rendering is a first-class protocol: the UI requests tile bitmaps at a given zoom/offset, LokiKit rasterises them via Skia and returns them as SKBitmap or raw pixel spans")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 46: StyledPara(StyledParagraph { style_id: Some(StyleId("ListParagraph")), direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: Some(ListId("2")), list_level: Some(0), outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 11.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.05882353, g: 0.09019608, b: 0.16470589 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("Commands are dispatched as structured messages (discriminated unions in C#), not direct method calls, enabling undo/redo, macros, and future CRDT collaboration")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 47: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: None, indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 0.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 6.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [Str("")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-Block 48: Heading(3, NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } }, [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Calibri"), font_name_complex: Some("Calibri"), font_name_east_asian: Some("Calibri"), font_size: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 12.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: Some(true), italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.050980393, g: 0.5803922, b: 0.53333336 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("LokiKit Core Interface")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })])
-Block 49: StyledPara(StyledParagraph { style_id: None, direct_para_props: Some(ParaProps { alignment: None, indent_start: Some(Length { value: 36.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), indent_end: None, indent_first_line: None, indent_hanging: None, space_before: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), space_after: Some(Exact(Length { value: 2.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> })), line_height: None, border_top: None, border_bottom: None, border_left: None, border_right: None, border_between: None, padding_top: None, padding_bottom: None, padding_left: None, padding_right: None, background_color: None, tab_stops: None, keep_together: None, keep_with_next: None, orphan_control: None, widow_control: None, page_break_before: None, page_break_after: None, column_break_after: None, list_id: None, list_level: None, outline_level: None, bidi: None, extensions: ExtensionBag { entries: [] } }), direct_char_props: None, inlines: [StyledRun(StyledRun { style_id: None, direct_props: Some(CharProps { font_name: Some("Courier New"), font_name_complex: Some("Courier New"), font_name_east_asian: Some("Courier New"), font_size: Some(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), font_size_complex: Some(Length { value: 10.0, _unit: PhantomData<loki_primitives::units::unit_types::Pt> }), bold: None, italic: None, underline: None, strikethrough: None, outline: None, shadow: None, small_caps: None, all_caps: None, vertical_align: None, color: Some(Rgb(RgbColor { r: 0.4862745, g: 0.22745098, b: 0.92941177 })), background_color: None, highlight_color: None, letter_spacing: None, word_spacing: None, kerning: None, scale: None, language: None, language_complex: None, language_east_asian: None, hyperlink: None, extensions: ExtensionBag { entries: [] } }), content: [Str("ILokiDocument")], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })], attr: NodeAttr { id: None, classes: [], kv: [], extensions: ExtensionBag { entries: [] } } })
-test diagnose_loki_architecture_import ... ok
-
-test result: ok. 1 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.05s
-