Gap 19: ODT macros and unknown package parts kept

Package parts WordCraft doesn't read were dropped on save. These
include LibreOffice Basic macros and dialogs (`Basic/`, `Dialogs/`),
`manifest.rdf` and other applications' files. They are now kept as
they are and written back with their manifest entries. LibreOffice
finds a round-tripped document's macro intact; WordCraft never runs
macros.

Dropped on save: the old thumbnail, and digital signatures
(`META-INF/*signatures*.xml`), because they sign the package as it
was. Also dropped: paths that climb out of the package, and paths
WordCraft writes itself (pictures, embedded objects).

Kept parts are bounded: 1000 files, 64 MiB in all. They survive
password protection.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBVQLyDnrG8Tn1yDQcUabC

crates/formats/src/odt.rs

@@ -52,6 +52,7 @@ mod import;
 mod limits;
 mod objects;
 mod package;
+mod parts;
 mod path;
 mod shapes;
 mod strokes;

crates/formats/src/odt/import.rs

@@ -408,6 +408,8 @@ struct Parsed {
     custom: Vec<wordcraft_doc::CustomProp>,
     /// The bibliography sources the citations carry.
     sources: Vec<wordcraft_doc::Source>,
+    /// The package's parts WordCraft doesn't read itself (macros…), kept for the next save.
+    kept: super::parts::Kept,
 }
 
 /// Hyphenation is a paragraph's in ODF (`fo:hyphenate`) and the document's in WordCraft (as in
@@ -459,6 +461,7 @@ fn parse_tracked(bytes: &[u8]) -> Result<Parsed, String> {
     }
     let entries: Vec<String> = z.file_names().take(100_000).map(str::to_string).collect();
     let manifest = read_entry(&mut z, "META-INF/manifest.xml").map(|m| super::objects::manifest(&m)).unwrap_or_default();
+    let kept = super::parts::read(&mut z, &entries, &manifest);
     let mut pictures = Pictures::new(MAX_ENTRY);
     let mut fetch = |path: &str| -> Option<Vec<u8>> {
         // A frame may point at any entry, as often as it likes: `Pictures` keeps that bounded.
@@ -520,6 +523,7 @@ fn parse_tracked(bytes: &[u8]) -> Result<Parsed, String> {
         hyphenate,
         custom,
         sources,
+        kept,
     })
 }
 
@@ -548,8 +552,10 @@ pub fn import(bytes: &[u8]) -> Result<Document, String> {
         hyphenate,
         custom,
         sources,
+        kept,
     } = parse_tracked(bytes)?;
     let mut doc = model::to_doc(&flow);
+    kept.store(&mut doc);
     doc.custom_props = custom;
     doc.sources = sources;
     doc.settings.auto_hyphenation |= hyphenate;

crates/formats/src/odt/package.rs

@@ -662,6 +662,17 @@ pub fn export(doc: &Document) -> Result<Vec<u8>, String> {
             x(dir)
         ));
     }
+    // The parts WordCraft doesn't read, as they were, unless one would take a path written here.
+    let (kept_files, kept_entries) = super::parts::kept(doc);
+    let dirs: Vec<String> =
+        w.objects.iter().map(|(d, _, _)| d).chain(w.object_dirs.iter().map(|(d, _)| d)).map(|d| format!("{}/", d.trim_end_matches('/'))).collect();
+    let taken = |p: &str| w.pictures.iter().any(|(n, _, _)| n == p) || dirs.iter().any(|d| p.starts_with(d.as_str()));
+    let kept_files: Vec<_> = kept_files.into_iter().filter(|(p, _)| !taken(p)).collect();
+    for (path, mime) in &kept_entries {
+        if (path.ends_with('/') && kept_files.iter().any(|(p, _)| p.starts_with(path.as_str()))) || kept_files.iter().any(|(p, _)| p == path) {
+            manifest.push_str(&format!("<manifest:file-entry manifest:full-path=\"{}\" manifest:media-type=\"{}\"/>\n", x(path), x(mime)));
+        }
+    }
     manifest.push_str("</manifest:manifest>\n");
 
     let err = |e: zip::result::ZipError| format!("ODT: {e}");
@@ -689,6 +700,10 @@ pub fn export(doc: &Document) -> Result<Vec<u8>, String> {
         z.start_file(name.as_str(), stored).map_err(err)?;
         z.write_all(data).map_err(ioerr)?;
     }
+    for (name, data) in &kept_files {
+        z.start_file(name.as_str(), deflated).map_err(err)?;
+        z.write_all(data).map_err(ioerr)?;
+    }
     let cur = z.finish().map_err(err)?;
     Ok(cur.into_inner())
 }

crates/formats/src/odt/parts.rs

@@ -0,0 +1,149 @@
+//! Package parts WordCraft doesn't read (ODF 1.3 Part 2 §3: any file a package lists), kept as
+//! they are and written back: macros and dialogs (`Basic/`, `Dialogs/`, `Scripts/`),
+//! LibreOffice's interface configuration (`Configurations2/`), metadata (`manifest.rdf`) and
+//! files of other applications.
+//!
+//! Not kept: what WordCraft reads and writes itself (content, styles, meta, settings, pictures,
+//! embedded objects), the thumbnail (it would show the document as it was), and digital
+//! signatures (`META-INF/*signatures*.xml`): they sign the package as it was, so a saved, changed
+//! document can't carry them.
+
+use std::sync::Arc;
+
+use wordcraft_doc::Document;
+
+/// `Document::passthrough` key prefix of a kept part (its path follows), and the key of the list
+/// of kept paths with their media types (`path\tmedia type` lines; directories end in `/`).
+pub(super) const PREFIX: &str = "odf-part/";
+pub(super) const LIST: &str = "odf-parts";
+
+/// Most parts kept, and most bytes in all.
+const MAX_PARTS: usize = 1000;
+const MAX_BYTES: u64 = 64 << 20;
+
+/// Whether package path `name` is one WordCraft reads or writes itself, or drops.
+fn own(name: &str, manifest: &std::collections::HashMap<String, String>) -> bool {
+    const OWN: [&str; 6] = ["mimetype", "content.xml", "styles.xml", "meta.xml", "settings.xml", "META-INF/manifest.xml"];
+    if OWN.contains(&name) || name.ends_with('/') {
+        return true;
+    }
+    if ["Pictures/", "Thumbnails/", "ObjectReplacements/"].iter().any(|d| name.starts_with(d)) {
+        return true;
+    }
+    if name.starts_with("META-INF/") && name.contains("signatures") {
+        return true;
+    }
+    // An embedded object's files: its directory is listed as an OpenDocument.
+    let mut dir = name;
+    while let Some((up, _)) = dir.rsplit_once('/') {
+        if manifest
+            .get(&format!("{up}/"))
+            .is_some_and(|m| m.starts_with("application/vnd.oasis.opendocument.") || m.starts_with("application/vnd.sun.xml.math"))
+        {
+            return true;
+        }
+        dir = up;
+    }
+    false
+}
+
+/// Whether `name` is a path safe to write back: relative, without `.` or `..` steps or empty
+/// ones, and of no more than 512 bytes.
+fn safe(name: &str) -> bool {
+    !name.is_empty()
+        && name.len() <= 512
+        && !name.starts_with('/')
+        && !name.contains('\\')
+        && name.split('/').all(|s| !s.is_empty() && s != "." && s != "..")
+        && !name.chars().any(char::is_control)
+}
+
+/// The parts of a package WordCraft doesn't read itself: each file's path and bytes, and the
+/// list of their paths with media types (see [`LIST`]).
+#[derive(Default)]
+pub(super) struct Kept {
+    files: Vec<(String, Vec<u8>)>,
+    list: String,
+}
+
+impl Kept {
+    /// Keeps them in `doc`, for the next save.
+    pub(super) fn store(self, doc: &mut Document) {
+        for (name, bytes) in self.files {
+            doc.passthrough.insert(format!("{PREFIX}{name}"), Arc::new(bytes));
+        }
+        if !self.list.is_empty() {
+            doc.passthrough.insert(LIST.into(), Arc::new(self.list.into_bytes()));
+        }
+    }
+}
+
+/// Reads the parts of package `z` (entries `entries`) WordCraft doesn't read itself, with their
+/// media types from `manifest`.
+pub(super) fn read(
+    z: &mut zip::ZipArchive<std::io::Cursor<&[u8]>>,
+    entries: &[String],
+    manifest: &std::collections::HashMap<String, String>,
+) -> Kept {
+    use std::io::Read;
+    let mut kept = Kept::default();
+    let mut budget = MAX_BYTES;
+    let mut dirs = std::collections::BTreeSet::new();
+    let clean = |m: &str| m.replace(['\t', '\n', '\r'], " ");
+    for name in entries {
+        if kept.files.len() >= MAX_PARTS || own(name, manifest) || !safe(name) {
+            continue;
+        }
+        let Ok(f) = z.by_name(name) else { continue };
+        if f.size() > budget {
+            continue;
+        }
+        let mut bytes = Vec::new();
+        if f.take(budget).read_to_end(&mut bytes).is_err() {
+            continue;
+        }
+        budget = budget.saturating_sub(bytes.len() as u64);
+        let mime = manifest.get(name.as_str()).map_or("", String::as_str);
+        kept.list.push_str(&format!("{name}\t{}\n", clean(mime)));
+        // The directories it is in that the manifest lists (a Basic library, a configuration).
+        let mut dir = name.as_str();
+        while let Some((up, _)) = dir.rsplit_once('/') {
+            let d = format!("{up}/");
+            if let Some(m) = manifest.get(&d) {
+                dirs.insert((d, clean(m)));
+            }
+            dir = up;
+        }
+        kept.files.push((name.clone(), bytes));
+    }
+    for (d, m) in dirs {
+        kept.list.push_str(&format!("{d}\t{m}\n"));
+    }
+    kept
+}
+
+/// The parts kept in `doc` to write back: (path, bytes) of each file, and (path, media type) of
+/// each manifest entry (directories too). Paths WordCraft writes itself are left out.
+pub(super) fn kept(doc: &Document) -> (Vec<(String, Arc<Vec<u8>>)>, Vec<(String, String)>) {
+    let mut files = Vec::new();
+    let mut entries = Vec::new();
+    let Some(list) = doc.passthrough.get(LIST).and_then(|l| std::str::from_utf8(l).ok()) else { return (files, entries) };
+    let empty = std::collections::HashMap::new();
+    for line in list.lines().take(MAX_PARTS * 2) {
+        let (path, mime) = line.split_once('\t').unwrap_or((line, ""));
+        let dir = path.ends_with('/');
+        let name = path.trim_end_matches('/');
+        if !safe(name) || own(path, &empty) && !dir {
+            continue;
+        }
+        if dir {
+            entries.push((path.to_owned(), mime.to_owned()));
+        } else if let Some(b) = doc.passthrough.get(&format!("{PREFIX}{path}")) {
+            files.push((path.to_owned(), b.clone()));
+            if !mime.is_empty() {
+                entries.push((path.to_owned(), mime.to_owned()));
+            }
+        }
+    }
+    (files, entries)
+}

crates/formats/src/odt/tests_more.rs

@@ -27,6 +27,7 @@ mod notes;
 mod numbering_fields;
 mod objects;
 mod outline;
+mod parts;
 mod page_setup;
 mod para_borders;
 mod polygons;

crates/formats/src/odt/tests_more/parts.rs

@@ -0,0 +1,104 @@
+//! Package parts WordCraft doesn't read (ODF 1.3 Part 2 §3): macros and dialogs (`Basic/`),
+//! LibreOffice's interface configuration, `manifest.rdf` and other applications' files are kept
+//! as they are and written back with their manifest entries; the thumbnail and digital
+//! signatures, which describe the package as it was, are not.
+
+use std::io::{Cursor, Read, Write};
+
+use crate::odt::tests::NS_T;
+use crate::odt::{decrypt, encrypt, export, import};
+
+const MODULE: &str = r#"<?xml version="1.0" encoding="UTF-8"?><script:module xmlns:script="http://openoffice.org/2000/script" script:name="Module1" script:language="StarBasic">Sub Hello
+  MsgBox "Hi"
+End Sub
+</script:module>"#;
+
+/// A package with parts WordCraft doesn't read, `extra` more files, and a manifest listing
+/// some of them.
+fn odt(extra: &[(&str, &[u8])]) -> Vec<u8> {
+    let content = format!(
+        r#"<office:document-content {NS_T}><office:body><office:text><text:p>Macro.</text:p></office:text></office:body></office:document-content>"#
+    );
+    let manifest = r#"<manifest:manifest xmlns:manifest="urn:oasis:names:tc:opendocument:xmlns:manifest:1.0" manifest:version="1.3"><manifest:file-entry manifest:full-path="/" manifest:media-type="application/vnd.oasis.opendocument.text"/><manifest:file-entry manifest:full-path="content.xml" manifest:media-type="text/xml"/><manifest:file-entry manifest:full-path="Basic/Standard/Module1.xml" manifest:media-type="text/xml"/><manifest:file-entry manifest:full-path="Basic/script-lc.xml" manifest:media-type="text/xml"/><manifest:file-entry manifest:full-path="Configurations2/" manifest:media-type="application/vnd.sun.xml.ui.configuration"/><manifest:file-entry manifest:full-path="manifest.rdf" manifest:media-type="application/rdf+xml"/><manifest:file-entry manifest:full-path="Thumbnails/thumbnail.png" manifest:media-type="image/png"/></manifest:manifest>"#;
+    let mut z = zip::ZipWriter::new(Cursor::new(Vec::new()));
+    let o = zip::write::SimpleFileOptions::default().compression_method(zip::CompressionMethod::Stored);
+    let files: Vec<(&str, &[u8])> = vec![
+        ("mimetype", b"application/vnd.oasis.opendocument.text"),
+        ("content.xml", content.as_bytes()),
+        ("META-INF/manifest.xml", manifest.as_bytes()),
+        ("Basic/Standard/Module1.xml", MODULE.as_bytes()),
+        ("Basic/script-lc.xml", b"<library:libraries/>"),
+        ("manifest.rdf", b"<rdf:RDF/>"),
+        ("Thumbnails/thumbnail.png", b"\x89PNG old"),
+        ("META-INF/documentsignatures.xml", b"<document-signatures/>"),
+        ("other-app/data.bin", b"\x00\x01\x02"),
+    ];
+    for (name, data) in files.into_iter().chain(extra.iter().copied()) {
+        z.start_file(name, o).unwrap();
+        z.write_all(data).unwrap();
+    }
+    z.add_directory("Configurations2/toolbar/", o).unwrap();
+    z.finish().unwrap().into_inner()
+}
+
+/// Each file of package `bytes` with its contents.
+fn files(bytes: &[u8]) -> Vec<(String, Vec<u8>)> {
+    let mut z = zip::ZipArchive::new(Cursor::new(bytes)).unwrap();
+    let mut out = Vec::new();
+    for i in 0..z.len() {
+        let mut f = z.by_index(i).unwrap();
+        let mut b = Vec::new();
+        f.read_to_end(&mut b).unwrap();
+        out.push((f.name().to_string(), b));
+    }
+    out
+}
+
+fn file<'a>(fs: &'a [(String, Vec<u8>)], name: &str) -> Option<&'a [u8]> {
+    fs.iter().find(|(n, _)| n == name).map(|(_, b)| b.as_slice())
+}
+
+#[test]
+fn macros_and_other_parts_survive_a_save() {
+    let saved = export(&import(&odt(&[])).unwrap()).unwrap();
+    let fs = files(&saved);
+    assert_eq!(file(&fs, "Basic/Standard/Module1.xml"), Some(MODULE.as_bytes()));
+    assert_eq!(file(&fs, "Basic/script-lc.xml"), Some(&b"<library:libraries/>"[..]));
+    assert_eq!(file(&fs, "manifest.rdf"), Some(&b"<rdf:RDF/>"[..]));
+    assert_eq!(file(&fs, "other-app/data.bin"), Some(&b"\x00\x01\x02"[..]));
+    // Listed in the manifest with their media types; a file the manifest didn't list isn't.
+    let manifest = String::from_utf8(file(&fs, "META-INF/manifest.xml").unwrap().to_vec()).unwrap();
+    for want in [
+        r#"manifest:full-path="Basic/Standard/Module1.xml" manifest:media-type="text/xml""#,
+        r#"manifest:full-path="manifest.rdf" manifest:media-type="application/rdf+xml""#,
+    ] {
+        assert!(manifest.contains(want), "{want} in {manifest}");
+    }
+    assert!(!manifest.contains("other-app") && !manifest.contains("Configurations2"), "{manifest}");
+    // The old thumbnail and the signatures (of the package as it was) are gone.
+    assert!(file(&fs, "Thumbnails/thumbnail.png").is_none() && file(&fs, "META-INF/documentsignatures.xml").is_none());
+    // And again after a second save.
+    let again = files(&export(&import(&saved).unwrap()).unwrap());
+    assert_eq!(file(&again, "Basic/Standard/Module1.xml"), Some(MODULE.as_bytes()));
+}
+
+#[test]
+fn kept_parts_survive_encryption() {
+    let saved = encrypt(&export(&import(&odt(&[])).unwrap()).unwrap(), "pw").unwrap();
+    let fs = files(&decrypt(&saved, "pw").unwrap());
+    assert_eq!(file(&fs, "Basic/Standard/Module1.xml"), Some(MODULE.as_bytes()));
+}
+
+#[test]
+fn parts_with_hostile_names_are_not_written() {
+    let bad: [(&str, &[u8]); 5] = [("../evil.txt", b"x"), ("a//b.txt", b"x"), ("./c.txt", b"x"), ("d\\e.txt", b"x"), ("f/../../g.txt", b"x")];
+    let fs = files(&export(&import(&odt(&bad)).unwrap()).unwrap());
+    for (name, _) in bad {
+        assert!(file(&fs, name).is_none(), "{name}");
+    }
+    assert!(fs.iter().all(|(n, _)| !n.contains("..")));
+    // Parts named as WordCraft's own are WordCraft's.
+    let own: [(&str, &[u8]); 2] = [("Pictures/stale.png", b"x"), ("ObjectReplacements/Object 9", b"x")];
+    let fs = files(&export(&import(&odt(&own)).unwrap()).unwrap());
+    assert!(file(&fs, "Pictures/stale.png").is_none() && file(&fs, "ObjectReplacements/Object 9").is_none());
+}

docs/file-format-parity.md

@@ -1,6 +1,6 @@
 # File-format parity with Microsoft Word
 
-> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-11-01 · **Change:** trivial (ODT table cell formulas as formula fields); previously trivial (ODT custom shapes drawn from their own geometry); previously trivial (ODT bibliography marks as citations of sources); previously trivial (ODT linked text boxes); previously trivial (ODT picture crops and contour wrapping); previously trivial (ODT fidelity re-estimated at ~85%); previously trivial (ODT custom document properties and user fields as DOCPROPERTY); previously trivial (ODT connectors read and written glued); previously trivial (ODT borders around text read and written); previously trivial (ODT index marks read and written as XE fields; an index held around its entries updates); previously trivial (ODT ruby read and written); previously trivial (ODT page breaks after a paragraph, kept lines, widow control, hyphenation, table alignment and width and row heights); previously trivial (in-line drawings raised or lowered by their run's position; ODT in-line frames keep their place on the baseline; leading's space after the last line; text box borders shown by LibreOffice); previously trivial (ODT form controls opened and saved as content controls); previously trivial (password-protected ODT opened and saved); previously trivial (ODT headers and footers keep their shapes, text boxes, charts and embedded objects on save); previously trivial (ODT embedded spreadsheets and OLE objects kept whole instead of lost; flat ODT sub-documents valid `office:document`s); previously trivial (ODT charts in drawing groups drawn on open); previously trivial (ODT charts opened and saved as editable charts; flat ODT sub-documents no longer end the body); previously trivial (ODT leading read as an at-least spacing); previously trivial (ODT tracked formatting changes; changed regions named by `xml:id`); previously trivial (ODT drop caps; tab stops no longer drop a paragraph's background); previously trivial (flat ODT `.fodt` opened and saved; ODT fidelity re-estimated at ~80%); previously trivial (ODT page settings; a footnote no longer takes a footer's text); previously trivial (ODT dates in their formats, sequences, chapters and references); previously trivial (ODT bookmarks over text); previously trivial (ODT tables of contents and indexes; ODT fidelity re-estimated); previously trivial (ODT polygons, polylines and paths); previously trivial (ODT arrowheads, dashes and gradients); previously trivial (ODT groups of shapes and pictures); previously trivial (ODT rotated and mirrored shapes and pictures); previously trivial (ODT drawing shapes read and written); previously trivial (ODT text box frames keep their line, fill, padding and fit); previously trivial (ODT Asian and complex-script fonts); previously trivial (ODT right-to-left paragraphs); previously trivial (ODT text boxes kept); previously trivial (ODT unnumbered headings detached from the outline); previously trivial (ODT contextual spacing and layout settings); previously trivial (ODT custom character styles kept); previously trivial (ODT list level positions); previously trivial (ODT custom paragraph styles kept); previously trivial (ODT equations written as formula objects); previously trivial (ODT numbered headings written as headings); previously trivial (ODT floating pictures); previously trivial (ODT paragraph borders and background); previously trivial (ODT heading numbering); previously trivial (ODT font-face names); previously trivial (ODT table cell borders and padding); previously trivial (ODT heading, title, quote and preformatted styles keep their look); previously trivial (ODT tab stops read and written); previously trivial (ODT character formatting read and written); previously trivial (ODT lists keep their number formats, bullets and identity); previously trivial (ODT comments read and written); previously trivial (ODT footnotes and endnotes read and written); previously trivial (ODT headers, footers and text fields written; fields read); previously trivial (ODT paragraph spacing, indents and line spacing read and written); previously trivial (a paragraph naming an undefined style is formatted as Normal, as in Word, #5077); previously trivial (a hyperlinked TOC writes its page numbers as `PAGEREF _Toc… \h` fields, as Word does, #5097); previously trivial (HTML import ends the empty comments <!--> and <!---> at once, #5040); previously trivial (chart and SmartArt text the font lacks is drawn in a fallback face, so Chinese labels no longer show boxes, #4720); previously trivial (bibliography sources keep a corporate author (`b:Corporate`): read, written, cited and listed whole, #4848); previously trivial (custom-property bookmark-link preservation, #4767); previously trivial (note conversion preserves content with an ordered reference/run walk, #4750); previously trivial (DOCX comment-ID save lookups); previously trivial (built-in heading styles have their outline level without `w:outlineLvl`, #4Line truncated
+> **Last reviewed:** 2026-10-11 · **Last updated:** 2026-11-01 · **Change:** trivial (ODT macros and unknown package parts kept); previously trivial (ODT table cell formulas as formula fields); previously trivial (ODT custom shapes drawn from their own geometry); previously trivial (ODT bibliography marks as citations of sources); previously trivial (ODT linked text boxes); previously trivial (ODT picture crops and contour wrapping); previously trivial (ODT fidelity re-estimated at ~85%); previously trivial (ODT custom document properties and user fields as DOCPROPERTY); previously trivial (ODT connectors read and written glued); previously trivial (ODT borders around text read and written); previously trivial (ODT index marks read and written as XE fields; an index held around its entries updates); previously trivial (ODT ruby read and written); previously trivial (ODT page breaks after a paragraph, kept lines, widow control, hyphenation, table alignment and width and row heights); previously trivial (in-line drawings raised or lowered by their run's position; ODT in-line frames keep their place on the baseline; leading's space after the last line; text box borders shown by LibreOffice); previously trivial (ODT form controls opened and saved as content controls); previously trivial (password-protected ODT opened and saved); previously trivial (ODT headers and footers keep their shapes, text boxes, charts and embedded objects on save); previously trivial (ODT embedded spreadsheets and OLE objects kept whole instead of lost; flat ODT sub-documents valid `office:document`s); previously trivial (ODT charts in drawing groups drawn on open); previously trivial (ODT charts opened and saved as editable charts; flat ODT sub-documents no longer end the body); previously trivial (ODT leading read as an at-least spacing); previously trivial (ODT tracked formatting changes; changed regions named by `xml:id`); previously trivial (ODT drop caps; tab stops no longer drop a paragraph's background); previously trivial (flat ODT `.fodt` opened and saved; ODT fidelity re-estimated at ~80%); previously trivial (ODT page settings; a footnote no longer takes a footer's text); previously trivial (ODT dates in their formats, sequences, chapters and references); previously trivial (ODT bookmarks over text); previously trivial (ODT tables of contents and indexes; ODT fidelity re-estimated); previously trivial (ODT polygons, polylines and paths); previously trivial (ODT arrowheads, dashes and gradients); previously trivial (ODT groups of shapes and pictures); previously trivial (ODT rotated and mirrored shapes and pictures); previously trivial (ODT drawing shapes read and written); previously trivial (ODT text box frames keep their line, fill, padding and fit); previously trivial (ODT Asian and complex-script fonts); previously trivial (ODT right-to-left paragraphs); previously trivial (ODT text boxes kept); previously trivial (ODT unnumbered headings detached from the outline); previously trivial (ODT contextual spacing and layout settings); previously trivial (ODT custom character styles kept); previously trivial (ODT list level positions); previously trivial (ODT custom paragraph styles kept); previously trivial (ODT equations written as formula objects); previously trivial (ODT numbered headings written as headings); previously trivial (ODT floating pictures); previously trivial (ODT paragraph borders and background); previously trivial (ODT heading numbering); previously trivial (ODT font-face names); previously trivial (ODT table cell borders and padding); previously trivial (ODT heading, title, quote and preformatted styles keep their look); previously trivial (ODT tab stops read and written); previously trivial (ODT character formatting read and written); previously trivial (ODT lists keep their number formats, bullets and identity); previously trivial (ODT comments read and written); previously trivial (ODT footnotes and endnotes read and written); previously trivial (ODT headers, footers and text fields written; fields read); previously trivial (ODT paragraph spacing, indents and line spacing read and written); previously trivial (a paragraph naming an undefined style is formatted as Normal, as in Word, #5077); previously trivial (a hyperlinked TOC writes its page numbers as `PAGEREF _Toc… \h` fields, as Word does, #5097); previously trivial (HTML import ends the empty comments <!--> and <!---> at once, #5040); previously trivial (chart and SmartArt text the font lacks is drawn in a fallback face, so Chinese labels no longer show boxes, #4720); previously trivial (bibliography sources keep a corporate author (`b:Corporate`): read, written, cited and listed whole, #4848); previously trivial (custom-property bookmark-link preservation, #4767); previously trivial (note conversion preserves content with an ordered reference/run walk, #4750); previously trivial (DOCX comment-ID save lookups); previously trivial (built-in heLine truncated
 
 Every format Word opens or saves, what WordCraft does with it, and how it's tested. Fidelity is the
 share of a typical real-world file's content and formatting that survives (read: shows correctly;
@@ -57,7 +57,7 @@ Weights are the share of a Word user's file traffic (estimate). Read/write: ✅
 | PDF export | 8% | W | — | ✅ | ~80% | 6–10 | `crates/pdf/src/tests.rs` | krilla: embedded subsets, selectable text incl. field results (#133); Hebrew and Arabic copy and search as whole words (right-to-left glyphs written in visual order, #1383, also with fonts that draw lam-alef as two glyphs at one x, #2310); All Caps and Small Caps text extracts as the capitals shown, as from Word's PDFs, and never changes the case of other text (#1473), links, outline, tagging. Outline destinations follow leading page breaks to the heading text. Fonts it can't subset become outlines (#132). Print Markup (#589): comments in balloons beside each page (scaled to its paper) and tracked changes; HTML/Markdown/text copies end with a comment list. Horizontal and vertical lines inside groups are drawn (#1474). No PDF/A option, no "best for printing/online" choice |
 | PDF open (PDF Reflow, Word for Windows) | 1% | R | ❌ | — | 0% | 30–50 | — | Converting a PDF into an editable document. A sibling app (PdfCraft) may supply the parser |
 | `.rtf` Rich Text Format | 3% | R/W | 🟡 | 🟡 | ~50% | 10–15 | `crates/formats/src/tests.rs` | ~1,500 lines: text, character/paragraph formatting, styles, lists, tables, pictures (`\shppict`, #154; Windows and Enhanced Metafiles, `\wmetafile` and `\emfblip`, read and written, #4259), fields, bookmarks. 8-bit text in the document's code page (`\ansicpg`) or the current font's (`\fcharset`, `\cpg`): Cyrillic, Central European, Greek, Turkish, Hebrew, Arabic, Baltic, Vietnamese, Thai (was Windows-1252 only), Mac OS Roman (`\mac`, `\fcharset77`) and DOS code pages (`\pc` 437, `\pca` 850, `\cpg` 437/737/850/852/857/866, `\fcharset254`) (#1653). East Asian multibyte code pages decoded as runs: 932 Shift-JIS (`\fcharset128`, Japanese), 936 GBK (134, Simplified Chinese), 949 UHC/windows-949 (129, Korean) and 950 Big5 (136, Traditional Chinese) through `\ansicpg`, `\cpg` or the font's charset, escaped or raw, a lead byte and its trail byte together; invalid sequences read as U+FFFD, and a run that starts `EF BB BF` is text, not a BOM (#1653). Pasted from the system clipboard where the platform offers it (Windows, Wayland) when there is no HTML (#687). Tracked insertions and deletions read and written (`\revtbl`, `\revised`/`\deleted`, authors, `\revdttm` dates), so Accept/Reject All work after opening or a round trip; tracked paragraph marks (`\par` inside `\revised`/`\deleted` groups, including a `\sect` inside a deletion) and character and paragraph formatting revisions (`\crauth`/`\crdate` with `\oldcprops`, `\prauth`/`\prdate` with `\oldpprops`) read and written; section and table formatting revisions (`\oldsprops`, `\oldtprops`) not yet. Sections on import (#1378): each `\sect` ends a section with its own page size and orientation, margins, header/footer distance, columns, break type, page-number restart, start and format, title page and headers/footers (those it leaves out link to the previous); export writes every section too (break type, page size and orientation, margins, header/footer distance, columns, page numbering, title page; not headers/footers). Thin: comments, notes, RTL |
-| `.odt` OpenDocument Text (and flat `.fodt`) | 2% | R/W | 🟡 | 🟡 | ~85% | 30–50 | `crates/formats/src/tests.rs`, `crates/formats/src/odt/tests.rs` and one file per feature in `crates/formats/src/odt/tests_more/`, `crates/engine/tests/it/odt_sections.rs`, `odt_toc.rs`, `odt_fields.rs`, `odt_charts.rs`, `odt_objects.rs`, `odt_password.rs`, `odt_forms.rs`; checked against LibreOffice's own documents (round trips compared page by page) and the ODF 1.3 schema | Ruby (`text:ruby`, §6.4: a base text with ruby text over it) is read as WordCraft's Phonetic Guide and written back as ODF ruby above its base, centred (one inside a tracked change is written as its base text, which the change marks); its own position and alignment aren't kept. A border around text (LibreOffice's `loext:border` or its sides, with `loext:padding`: ODF 1.3 has no attribute for it) is Word's text border, one line all round, and is written back so (a document with one is then extended ODF, not strict). Emphasis marks (`style:text-emphasize`) and rotated text (`style:text-rotation-angle`) aren't read. How text flows: a page break after a paragraph (`fo:break-after`, a page break before the next paragraph as Word has it), lines kept together (`fo:keep-together`), widow and orphan control (`fo:widows`/`fo:orphans`: on with any line count, off with none; the counts themselves aren't kept) and hyphenation (`fo:hyphenate`, a paragraph's in ODF and the document's in WordCraft: a document with a hyphenated paragraph hyphenates, its other paragraphs opting out) are read and written; a table's alignment and width (`table:align`, `style:rel-width`, or `style:width` for an aligned table) and its rows' heights (`style:row-height` exact, `style:min-row-height` at least) are read and written. Form controls (`office:forms` controls placed by `draw:control`, ODF 1.3 §13) open as content controls — text fields and text areas as plain text controls, check boxes as check boxes, radio buttons as check boxes with round symbols, list boxes as drop-down lists, combo boxes as combo boxes, date fields as date controls, each with its value, entries and selection, its name as the control's tag and a label as its title — and content controls of those kinds in the body are written back as form controls LibreOffice shows with their values (in headers and footers, as their text); buttons, images, hidden and other controls aren't read, and a control's size and look aren't kept. Password-protected ODT (ODF 1.3 Part 2 §3.4) opens with its password — AES-256-CBC with a SHA-256 or SHA-1 start key and PBKDF2, as LibreOffice writes it; the old Blowfish encryption is refused with a message saying so — and a document opened with a password, or saved with one (Save with password), is written encrypted the way LibreOffice encrypts (every file but the `mimetype` and manifest; each with its own salt and initialisation vector; SHA-256 checksums), which LibreOffice opens with the password. Flat OpenDocument text (`.fodt`: the whole document in one `office:document`, pictures inline as base64 `office:binary-data`, formulas inline) is opened and saved as a package is, both validating against the schema. Tables of contents and other indexes (`text:table-of-content`, `text:illustration-index`/`text:table-index`, `text:alphabetical-index`, `text:bibliography`) open as Word's `TOC` (levels from the source's `text:outline-level`; `\c` with the caption name for a table of figures), `INDEX` and `BIBLIOGRAPHY` fields — in the title paragraph when the index has one, as WordCraft inserts a table, else around the entries — so References › Update Table regenerates them; LibreOffice's Contents 1–10, Contents Heading and Figure Index 1 styles are WordCraft's TOC 1–9, TOC Heading and Table of Figures; WordCraft's tables are written back as ODF indexes with their source and entry templates (LibreOffice updates them), entries' links in the Index Link style; user and object indexes are read as their paragraphs; index marks are Word's `XE` fields — a mark at a point (`text:alphabetical-index-mark`, its `text:key1`/`text:key2` the levels above its entry) and one over text (`-mark-start`…`-mark-end` in one paragraph, its entry the marked text) — and `XE` fields are written as point marks, so References › Update Index rebuilds an ODT index from its entries (an index or other generated list held as a field around its entries, as ODT and Word files hold it, is first made the field's own paragraph, as WordCraft inserts one). Custom character styles (a common text style other than LibreOffice's link, note-mark and list-label styles kept as a character style with its name, parent and own formatting, its text in it; written back as common text styles), custom paragraph styles (a common style other than Standard, the kinds' and the note texts' kept as a document style with its name, parent and own formatting, its paragraphs in it rather than given its formatting directly; written bLine truncated
+| `.odt` OpenDocument Text (and flat `.fodt`) | 2% | R/W | 🟡 | 🟡 | ~85% | 30–50 | `crates/formats/src/tests.rs`, `crates/formats/src/odt/tests.rs` and one file per feature in `crates/formats/src/odt/tests_more/`, `crates/engine/tests/it/odt_sections.rs`, `odt_toc.rs`, `odt_fields.rs`, `odt_charts.rs`, `odt_objects.rs`, `odt_password.rs`, `odt_forms.rs`; checked against LibreOffice's own documents (round trips compared page by page) and the ODF 1.3 schema | Ruby (`text:ruby`, §6.4: a base text with ruby text over it) is read as WordCraft's Phonetic Guide and written back as ODF ruby above its base, centred (one inside a tracked change is written as its base text, which the change marks); its own position and alignment aren't kept. A border around text (LibreOffice's `loext:border` or its sides, with `loext:padding`: ODF 1.3 has no attribute for it) is Word's text border, one line all round, and is written back so (a document with one is then extended ODF, not strict). Emphasis marks (`style:text-emphasize`) and rotated text (`style:text-rotation-angle`) aren't read. How text flows: a page break after a paragraph (`fo:break-after`, a page break before the next paragraph as Word has it), lines kept together (`fo:keep-together`), widow and orphan control (`fo:widows`/`fo:orphans`: on with any line count, off with none; the counts themselves aren't kept) and hyphenation (`fo:hyphenate`, a paragraph's in ODF and the document's in WordCraft: a document with a hyphenated paragraph hyphenates, its other paragraphs opting out) are read and written; a table's alignment and width (`table:align`, `style:rel-width`, or `style:width` for an aligned table) and its rows' heights (`style:row-height` exact, `style:min-row-height` at least) are read and written. Form controls (`office:forms` controls placed by `draw:control`, ODF 1.3 §13) open as content controls — text fields and text areas as plain text controls, check boxes as check boxes, radio buttons as check boxes with round symbols, list boxes as drop-down lists, combo boxes as combo boxes, date fields as date controls, each with its value, entries and selection, its name as the control's tag and a label as its title — and content controls of those kinds in the body are written back as form controls LibreOffice shows with their values (in headers and footers, as their text); buttons, images, hidden and other controls aren't read, and a control's size and look aren't kept. Package parts WordCraft doesn't read — LibreOffice Basic macros and dialogs (`Basic/`, `Dialogs/`), `manifest.rdf`, other applications' files — are kept as they are and written back with their manifest entries, so LibreOffice still finds a document's macros (WordCraft never runs them); the old thumbnail and digital signatures (`META-INF/*signatures*.xml`, which sign the package as it was) are dropped on save, and paths that climb out of the package aren't written. Password-protected ODT (ODF 1.3 Part 2 §3.4) opens with its password — AES-256-CBC with a SHA-256 or SHA-1 start key and PBKDF2, as LibreOffice writes it; the old Blowfish encryption is refused with a message saying so — and a document opened with a password, or saved with one (Save with password), is written encrypted the way LibreOffice encrypts (every file but the `mimetype` and manifest; each with its own salt and initialisation vector; SHA-256 checksums), which LibreOffice opens with the password. Flat OpenDocument text (`.fodt`: the whole document in one `office:document`, pictures inline as base64 `office:binary-data`, formulas inline) is opened and saved as a package is, both validating against the schema. Tables of contents and other indexes (`text:table-of-content`, `text:illustration-index`/`text:table-index`, `text:alphabetical-index`, `text:bibliography`) open as Word's `TOC` (levels from the source's `text:outline-level`; `\c` with the caption name for a table of figures), `INDEX` and `BIBLIOGRAPHY` fields — in the title paragraph when the index has one, as WordCraft inserts a table, else around the entries — so References › Update Table regenerates them; LibreOffice's Contents 1–10, Contents Heading and Figure Index 1 styles are WordCraft's TOC 1–9, TOC Heading and Table of Figures; WordCraft's tables are written back as ODF indexes with their source and entry templates (LibreOffice updates them), entries' links in the Index Link style; user and object indexes are read as their paragraphs; index marks are Word's `XE` fields — a mark at a point (`text:alphabetical-index-mark`, its `text:key1`/`text:key2` the levels above its entry) and one over text (`-mark-start`…`-mark-end` in one paragraph, its entry the marked text) — and `XE` fields are written as point marks, so References › Update Index rebuilds an ODT index from its entries (an index or other generated list held as a field around its entries, as ODT and Word files hold it, is first made the field's own paragraph, as WordCraft inLine truncated
 | `.txt` Plain text | 2% | R/W | ✅ | ✅ | ~95% | 1–2 | unit tests | Encoding detection. Files with other extensions (`.m3u`/`.m3u8` playlists, logs, config files, no extension) open as text when they are text, Word and RTF files by their signature; binary files are refused (#569). A Word or RTF extension that contradicts the content also opens by signature, as in Word: RTF saved as `.doc` (hh.ru résumés, accounting exports), a `.docx` renamed `.doc`, a Word 97-2003 file renamed `.docx`; a Word XML Document (Word 2003 XML or Flat OPC) or a web page (`<html>`, `<!DOCTYPE html>`) under a `.doc`, `.docx` or `.rtf` name opens as what it is (#2853, `tests::word_xml_and_web_pages_saved_as_doc_open_by_content`). Word's encoding choice dialog and line-ending options missing; such files save only through Save As |
 | `.htm/.html` Web Page and Web Page, Filtered | 1% | R/W | 🟡 | 🟡 | ~60% | 6–10 | `crates/formats/src/tests.rs` | Tables (#102), relative pictures embedded (#113), missing `</head>` tolerated (#154); the empty comments `<!-->` and `<!--->` end at once instead of swallowing the rest of the page (#5040). Header cells (`<th>`) bold unless their CSS says otherwise; `text-align` on a cell, or inherited from its row, row group or table, aligns the cell's paragraphs (#1381). HTML gives no page size, so it opens on the region's paper (A4 or Letter), as Markdown and plain text do; `@page` isn't read (#1381). No Word "Web Page" (with `_files` folder) round-trip. The same reader takes HTML from the system clipboard: Paste keeps another program's formatting (a Word document, a web page; Windows' "HTML Format" header understood), Merge Formatting keeps its emphasis (#687). A pasted `<blockquote>` (LibreOffice's paragraph indented on both sides) becomes a Normal paragraph indented by the page's `blockquote` margins, else 0.5 in each side; opening an .html file keeps it as the Quote style (#1270). Equations are written as MathML (with the linear format as a UnicodeMath annotation) and read back from MathML: our annotation, else the presentation elements, else a TeX annotation (#816). A copy of one equation alone also goes in the clipboard's MathML formats (Windows "MathML" and "MathML Presentation", macOS `public.mathml.presentation` and `public.mathml`; W3C MathML 3 §6.2.4), which Microsoft documents Word reading first when it pastes math (#1297; the paste into Word is not yet verified); Ruby (furigana, phonetic guides) is written as `<ruby>base<rt>reading</rt></ruby>` in the base text's formatting and read back from `<ruby>`/`<rb>`/`<rt>` (`<rp>` fallback parentheses dropped; malformed markup keeps its text), so docx/doc → HTML → doc keeps the annotation; HTML states no alignment, size or raise, so the Phonetic Guide's defaults apply (#1681)  CRLF and lone CR input newlines normalize before tokenization, preserving preformatted lines and leaving decoded character references separate (#4810). |
 | `.mht/.mhtml` Single File Web Page | <1% | R/W | ❌ | ❌ | 0% | 3–5 | — | |
@@ -279,6 +279,7 @@ Custom document properties retain their bookmark link targets through DOCX saves
 
 | Date | Change | Summary |
 |---|---|---|
+| 2026-11-01 | trivial | ODT: package parts WordCraft doesn't read (LibreOffice Basic macros, `manifest.rdf`, other applications' files) were dropped on save; they are kept and written back with their manifest entries, and LibreOffice finds a round-tripped document's macro intact; thumbnails and signatures are dropped (`odt::tests_more::parts`) |
 | 2026-11-01 | trivial | ODT: table cell formulas (`table:formula`) were lost, leaving their value as text; LibreOffice's formulas open as Word formula fields that Update Field recalculates, and formula fields in cells are written back as cell formulas LibreOffice calculates (numbers in cells written as numbers, `ooow` declared); a LibreOffice table of sums round-trips with its text the same (`odt::tests_more::cell_formulas`, `odt_fields.rs::a_table_formula_updates_as_a_word_formula`) |
 | 2026-11-01 | trivial | ODT: custom shapes of a type WordCraft has no kind for (hexagon, smiley, can, moon, lightning, block arc…) opened as rectangles; they are drawn from their own enhanced path and equations as freeforms, and a freeform with closed and open paths is saved as a custom shape so LibreOffice fills its closed parts; LibreOffice's preset shapes render as LibreOffice draws them (`odt::tests_more::custom_geometry`) |
 | 2026-11-01 | trivial | ODT: citations (`text:bibliography-mark`) were read as text and their sources lost; they are `CITATION` fields of the document's sources, so a bibliography updates from them, written back as marks carrying their source; a LibreOffice citation and bibliography round-trip pixel-identical (`odt::tests_more::fields::bibliography_marks_are_citations_of_sources`, `odt_toc.rs::an_odt_bibliography_updates_from_its_citations_sources`) |